Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Freshy Recipes, used by 2,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by other. It comes from a trusted publisher and was last updated in October 2021.
Key findings
- High
Other
The `onmessage` handler accepts navigation instructions from ANY origin with no `event.origin` check. Because the iframe URL is fully server-controlled (set via `newtab_path` cookie from `[domain withheld]`), the server can load any page in the iframe that then posts `{url: '[domain withheld]'}` to redirect the user's new tab to an arbitrary destination. This is an open-redirect primitive triggered by untrusted cross-origin content.
- Medium
Tracking
Top-sites (full list of most-visited URLs) are posted to the iframe with `"*"` as the target origin rather than a specific expected origin. Since the server can change the iframe URL to any host via the `newtab_path` setting (injected through the `ext_config` cookie on `[domain withheld]`), a server-side update could silently redirect the iframe to an unrelated third-party host that then receives the complete browsing-history dataset on every new tab open. While "Web history" is CWS-disclosed, the wildcard target means disclosure cannot be scoped to the publisher's own domains.
Analyst notes
The extension is a new tab hijacker with server-controlled iframe content (URL determined by `[domain withheld]`) and two concrete security issues: (1) `window.onmessage` in has no origin validation, allowing any page loaded in the iframe to navigate the user to an arbitrary URL; (2) `returnMessage` posts top-sites data via `postMessage(..., "*")`, so if the server changes `newtab_path` to a non-publisher URL, that third-party page silently receives full browsing history. Publisher reputation strongly corroborates suspicion — 50% of their other extensions are flagged malicious — while the low ML score (0.20) and small clean permhash cluster somewhat contradict it; the third-party risk score is low, consistent with a PUP rather than an active credential-stealer.
Freshy Recipes Chrome extension security report
ID: lkfegegmfppkbbacbpknfiifgbmcdbhl
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Freshy
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 248 3rd Street Oakland, CA 94607 US
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
- 1 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Manage, View, Save, and Print Recipes using browser extension on New Tab.
Read the publisher’s full description
Get Recipes in your browser New Tab, the Extension provide easy way to add new recipes in your Cook Book from popular cooking sites. You can manager, view and print instructions from browser New Tab. The extension automatically parse recipes related data such as title, ingredients, instructions, cook time etc and provide easy to read and printable view of your recipe. This extension updates your browser New Tab and provides: - Search, View, Save and Print Recipes - List of Popular Recipes - Add Recipes to Cook Book - Links to TopSites By installing this extension, you agree to the Terms of Service (https://freshyrecipes-site.com/terms-of-service/) and Privacy Policy (https://freshyrecipes-site.com/privacy-policy/) Permissions used & reasons: "Read and change your data on a number of websites" For our extension to work, we require access to these websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page. "Read your browsing history" This allows us to manage browser tabs and provide relevant product specific information.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from Freshy
- Freshy Search10,000 users
- Freshy Search10,000 users
- Freshy Recipes5,341 users
- Search Freshy4 users
Popular in Just for Fun
- Custom Cursor for Chrome™6,000,000 users
- Return YouTube Dislike5,000,000 users
- Stylish - Custom themes for any website2,000,000 users
- Google Meet Enhanced Experience1,000,000 users
- FrankerFaceZ1,000,000 users