Chrome Web StoreNo malware found
In code review (v0.1.8)
Our reviewer read version 0.1.8 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.
228 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
HiTab - New Tab Dashboard and Widgets, used by 5,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 medium), led by unauthorized data collection. Its permissions mean it can read and change data on all websites.
Key findings
- Medium
Unauthorized Data Collection
When `needInfinityFavicon` is set, the history and bookmarks widgets build every icon URL by embedding the visited site's hostname in a request to [domain withheld] - a third party belonging to an unrelated new-tab extension, not [domain withheld] or any domain on the publisher's privacy policy - so each rendered entry discloses its hostname to that host while the CWS listing declares no data collection at all. This is not a user toggle::80-86 calls `setFavicon(true)` automatically in the permission-request error path whenever the browser replies "'favicon' is not a recognized permission.", so on any Chromium build without the favicon permission (the targets the reviews mention) the third-party path becomes the silent default for users who granted only history or bookmarks. It stays medium rather than higher because the data is hostname-only, passive image fetches, and serves the widget's genuine icon-rendering purpose; the local chrome.runtime.getURL(' /') branch shows a first-party alternative exists.
Analyst notes
Every code path in the 49 supplied JS files is an ordinary Vue 3 + Pinia + Workbox new-tab dashboard: widgets gated behind chrome.permissions.request (:51-86), a GA4 install-only ping carrying just {appVersion, platform} (:316-325), and a self-hosted Baidu Tongji copy () that cannot execute on web pages because the manifest declares no content_scripts - which makes the risk engine's 'Broad Content Script Access' finding factually wrong for this manifest. The bundled and published manifests agree exactly, so there is no delayed-update mismatch; the one real defect is an automatic, undisclosed fallback that routes hostnames to a third-party favicon CDN. Confidence is low purely for coverage: the bundle supplied 49 JS files / ~1.3 MB against the ML stats' 454 files / 227 JS / 7.7 MB, with no, no _locales, no CSS and no HTTP client - the, and login code that the service-worker router (:1496-1528) proves exists is absent, as is the Pinia `syncStorage` plugin that persists the watched `historyRecord` state, so I cannot see that store's persistence target. The Koi DarkSpectre IoC listing, the publisher-malicious flag and the 26%-malicious permhash cluster are therefore left uncorroborated rather than refuted.
HiTab - New Tab Dashboard and Widgets Chrome extension security report
ID: doeomodlafdbbnajjllemacdfphbbohl
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- hitab.me
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
228 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Customize your homepage with widgets, and dark mode support
Read the publisher’s full description
HiTab - New Tab Dashboard and Widgets. New Tab Dashboard and Widgets. Personal dashboard organizes bookmarks, favorite websites from start page. HiTab supports customizing your homepage with widgets, including dark mode. Hitab - New Tab Dashboard and Widgets，Hitab is a new tab extension for iOS that allows you to create your own visually appealing homepage with customizable widgets. It features card-style design, built-in features such as countdowns, anniversaries, weather, hot searches, and a calculator. Hitab makes all the information easily accessible, keeping your new tab page clean and beautiful. Here are some key features of Hitab new tab: 1. Customize widgets and icons on your new tab page, freely arrange and mix and match them. 2. Personalize birthday countdown widgets, payday countdown widgets, holiday widgets, etc. 3. Quickly add frequently visited websites or widgets to your homepage. 4. Customize search engines and toggle between Google, Bing, Yahoo, and other search engines. You can also add your own custom search engines. 5. Customize wallpapers with a wide selection of high-definition wallpapers in categories such as nature, ocean, architecture, animals, etc. 6. Note-taking and to-do list widgets to keep your inspirations and tasks organized. 7. Customize dark or light mode, or automatically follow your system settings. 8. Customize the left sidebar with categorized icons for easy access to office and entertainment apps. You can hide or show the sidebar as needed. 9. Customize the bottom bar to store frequently used websites for convenient one-click access. You can hide or show the bottom bar. 10. Login/register a Hitab new tab account to backup and sync your data across different devices. 11. Receive message notifications from us. 12. Ability to adjust the icon size. 13. Hot search widgets. 14. Ability to adjust the icon width. 15. Ability to adjust the icon size to small, medium, or large. 16. Unit converter widget supporting calculators, length, weight, area, volume, temperature, speed, unit conversion, heat, pressure, power, force, etc. 17. Calendar widget. 18. Daily quotes widget. 19. News widget. 20. Habit tracker widget. 21. System status widget displaying real-time CPU, battery, and memory usage. 22. Currency exchange rate converter widget. 23. Mini game widget. 24. Dynamic wallpapers and gradient backgrounds. 25. Bookmark manager widget for easy bookmark management. 26. Full-screen clock widget and world time widget in the new tab. 27. Minimalist mode support for new tab. Online version: https://web.hitab.me/ Official website: https://www.hitab.me/
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
228 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in Functionality & UI
- IDM Integration Module21,000,000 users
- Hola VPN - Your Website Unblocker4,000,000 users
- Video Speed Controller3,000,000 users
- SponsorBlock for YouTube - Skip Sponsorships2,000,000 users
- Click&Clean1,000,000 users