What our analysis found

JoyTab - Your News Tab, used by 2,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (2 medium), led by tracking. It comes from a trusted publisher and was last updated in May 2023.

Key findings

• medium· tracking —The extension reads the user's most-visited site URLs via chrome.topSites.get() and immediately embeds each URL verbatim in an HTTP request to (a third-party favicon service). Every page-load sends the user's browsing history to a domain unrelated to the publisher (). The CWS disclosure states 'none' for data collection, so this is an undisclosed transmission of sensitive browsing data to a third party.
• medium· other —The bundled manifest declares host_permissions [*://*/*], granting the extension access to all websites, but the published CWS manifest summary omits this field entirely. Users reviewing the install prompt would not see this permission. This discrepancy between what is bundled and what is publicly disclosed is itself a finding regardless of whether the broader permission is currently exploited.

The extension's core NYT RSS reader and new-tab functionality is consistent with its stated purpose, and the ML signals (jQuery bundle, canvas data-URI caching) are explainable false hits. However, the extension passes the user's actual top-visited site URLs to the third-party service for favicon resolution (:31), which constitutes undisclosed transmission of browsing-history data to a domain wholly unrelated to the publisher (); CWS declares 'none' for data collection. This is corroborated by the publisher's 100% malicious rate on its other extensions and a permhash cluster where 26% of peers are flagged as malware. The bundled manifest also declares host_permissions [*://*/*] that do not appear in the published-manifest summary, widening the attack surface beyond what users see during install.