i New Tab

The entire 96KB itab.js is wrapped in a custom eval()-based deobfuscator that decodes a backtick-compressed string at runtime. This technique is deliberately used to hide the file's true behavior from static analysis tools and human reviewers. The CSP explicitly permits 'unsafe-eval' to enable this pattern, and common.js uses the identical obfuscator.

eval((function(x) {      var d = "";      var p = 0;      while (p < x.length) {        if (x.charAt(p) != "`") d += x.charAt(p++);        else {          var l = x.charCodeAt(p + 3) - 28;          if (l > 4) d += d.substr(d.length - x.charCodeAt(p + 1) * 96 - x.charCodeAt(p + 2) + 3104 - l, l);          else d += "`";          p += 4        }      }      return d    })("var lang=\"en\";$(function(){...

The Bing search engine entry is silently replaced with 'http://www.hbsohu.xyz/Results.aspx?GD=SY...&Source=69&UM=8' — a known affiliate/tracking domain. Every Bing search query typed into the extension's search bar is redirected through this third-party URL containing affiliate tracking parameters (Source, UM, GD), monetizing user searches without disclosure. The obfuscated URL also contains partially-encoded segments to evade static detection.

searchMaps = {  bing: {    type: "bing",    desc: "Bing",    url: " http://www.hbsohu.xyz/Results.aspx?GD=SY...19&Source=69&UM=8&n=2001&q=%s",    default_url: "bing.com/..."  }}

The content script runs on every http/https page, sends the current page URL to the background script, receives back a screenshot URL, renders it onto an HTML5 canvas, and returns the full canvas pixel data (via toDataURL()) and the page URL back to the background. This constitutes a screenshot-of-every-visited-page mechanism running silently across all browsing activity. The 'all_frames: true' declaration means it also runs inside iframes.

chrome.extension.sendMessage({  name: "oncompletes",  url: document.location.href}, function(e) {  if (e) {    var o = e.screenshotUrl,      t = (e.width, e.height),      n = document.createElement("canvas"),      c = new Image;    c.onload = function() {      n.width = $(window).width() / $(window).height() * t, n.height = t, n.getContext("2d").drawImage(c, 0, 0, n.width, n.height);      var e = $(n);      e.data("scrollLeft", $(document.body).scrollLeft()), e.data("scrollTop", $(document.body).scrollTop()), chrome.extension.sendMessage({        name: "screenshot",        url: document.location.href,        img: n.toDataURL()      }, function(e) {})    }, c.src = o  }})

The HiddenCapture class creates a browser window positioned 100,000px off-screen (left:1e5, top:1e5, focused:false) so it is invisible to the user, navigates it to a target URL, resizes it to 1024x768, and uses chrome.tabs.captureVisibleTab() to take a screenshot of the rendered page. The screenshot data URL is then returned via callback and stored to the filesystem. This is a covert page-rendering and screenshot-capture facility operating outside the user's visible viewport.

HiddenCapture = new function() {    ...this.capture = function(a, s) {      ...      var i = {        url: a.url,        focused: !1,        left: 1e5,        top: 1e5,        width: r ? 100 : 1,        height: r ? 100 : 1,        type: "popup"      };chrome.windows.create(i, function(r) {          ...chrome.windows.update(r.id, {              width: 1024,              height: 768            }, function() {              setTimeout(function() {                    chrome.tabs.captureVisibleTab(r.id, function(t) {                      if (clearTimeout(o), chrome.windows.remove(r.id), !t) return console.error("Fail to capture tab ", ...);                      w({                        imgUrl: t,                        screenWidth: a.width                      }, function(t, n) {                        s({                          dataUrl: t,                          title: e.title,                          thumbSize: n                        })                      })                    })

The background listens for 'thumb_hidden_capture' requests, invokes HiddenCaptureQueue to silently capture screenshots of arbitrary URLs, and writes the resulting images to '/snapshot/{id}.{ext}' in persistent storage. A queue system (HiddenCaptureQueue) manages concurrent capture jobs. This infrastructure can capture and persist screenshots of any URL at the direction of the new-tab page UI.

chrome.extension.onRequest.addListener(function(i, t, r) {      "thumb_hidden_capture" == i.name && HiddenCaptureQueue.capture(i, function(e) {        if (i.saveImage) {          var t = l(e.dataUrl),            n = f(t.type);          Storage.FileSystem.write("/snapshot/" + i.id + "." + n, t, function(t, n) {            t || (e.dataUrl = n), r({              result: e            })          })        }      }), "wallpaper" == i.name && ..., "custom_image" == i.name && ...

The weather widget sends the user's city (derived from geolocation or user input) to 'http://plugins.eagleget.com/delivery_zip2.php' over unencrypted HTTP. The endpoint name 'delivery_zip2' is anomalous for a weather API and the server is controlled by the extension publisher. Combined with the geolocation permission, this enables precise location tracking of users.

$.ajax({      url: "http://plugins.eagleget.com/delivery_zip2.php",      data: {        city: e      },      dataType: "json",      success: function(e) {        if (Array.isArray(e) && 0 < e.length && "string" == typeof e[0].name...a.fcd(a, e);        }      }    }

The extension phones home to 'http://plugins.eagleget.com/index.php' passing 'mt' (content type), 'ned' (navigator.language — user's browser locale), and a version identifier. This endpoint controls what content (news, apps, top sites) is shown on the new tab page and can remotely alter the page's behavior. Sending navigator.language allows user profiling by locale.

PageDataSource = {    load: function(e) {        ...e.join(",");d_.getCache("http://plugins.eagleget.com/index.php", {            mt: a,            ned: navigator.language          }, timeout: 10000...for(t in data) {            switch ("news" == t...              case "apps": GamePage...            }          }        }

On every popup open, the background retrieves the user's complete bookmarks tree via chrome.bookmarks.getTree() and the full list of recent tabs (with URLs), packaging them into the popup's initial data payload. Both the entire bookmark hierarchy and complete recent browsing history are accessible to the new tab page JavaScript, which also calls multiple external eagleget.com endpoints.

r.on("popupReady", function(t, n) {  var e = {    topPos: settingMachine.topPos,    opened: settingMachine.opened,    settings: settingMachine.windowConfig  };  t.from && "index" == t.from || ga("send", "pageview", "popup"), chrome.bookmarks.getTree(function(t) {    e.bookmarks = t, n(e)  })}), r.on("getRecentTabs", function(t, n) {  n(recent_tabs)})

The obfuscated itab.js invokes chrome.management.setEnabled() (partially visible despite obfuscation) to programmatically enable or disable other installed extensions. This constitutes privilege escalation: a new tab replacement extension should have no need to control other extensions, and this capability can be used to disable security tools or competing extensions.

chrome.management.setE...` =!`"e-`(n%` _*` W0` B%(e` V.`+("` C>` ? % ` _"TabView` ^ 'selectTab...

The manifest explicitly whitelists 'unsafe-eval' in its Content Security Policy, which is required to execute the eval()-based obfuscation present in itab.js and common.js. Legitimate extensions have no need for unsafe-eval; its presence here is a deliberate measure to enable runtime code execution from obfuscated strings, bypassing normal CSP protections.

{  "content_security_policy": [    "script-src 'self' https://apis.google.com/ chrome-extension://hdkdmoacnkphoadmfidlhfdobieblphn/script/analytics.js chrome-extension://hdkdmoacnkphoadmfidlhfdobieblphn/script/ 'unsafe-eval'",    "object-src 'self'"  ]}

The extension loads personalized 'recommended' content (links, wallpapers, top sites) from plugins.eagleget.com/index.php with a version identifier, locale, and timestamp on every new tab load. This remote content-loading mechanism allows the server operator to modify the links and sponsored content displayed to 408,000+ users at any time, acting as a remote code/content injection vector.

p_d = {    wpId: "",    iurl: "http://plugins.eagleget.com/index.php",    ...d_.getCache(iurl, Number.MAX_VALUE);e && e.data && (p_d.execShowset(e.s...), Dogear.Links...$.isArray(links) && ...$(window).on("pages:firstPageOnLoad", ..."recommend"; t.accept...d_(...{          rn: Date.now(),          v: api.getVersion(),          mt: e        }...)

Google Analytics is initialized with 'displayfeatures' enabled (ga("require","displayfeatures")), which collects demographic and interest category data from users for advertising purposes. Combined with the extension's access to full browsing history, tabs, and bookmarks, this enables rich behavioral profiling of every user. The GA property UA-36036708-10 is owned by the extension authors.

! function(e, n, t, a, s, i, o) {  e.GoogleAnalyticsObject = s, e[s] = e[s] || function() {    (e[s].q = e[s].q || []).push(arguments)  }, e[s].l = 1 * new Date, i = n.createElement(t), o = n.getElementsByTagName(t)[0], i.async = 1, i.src = a, o.parentNode.insertBefore(i, o)}(window, document, "script", "chrome-extension://hdkdmoacnkphoadmfidlhfdobieblphn/script/analytics.js", "ga"), setTimeout(function() {  ga("create", "UA-36036708-10", "auto"), ga("require", "displayfeatures"), ga("send", "pageview", "/index.html")}, 2e3);