Media Tab

The new tab override page immediately injects a meta http-equiv=refresh tag that redirects every new tab opened by the user to https://www.mediatab.club/sapi/rd.html, a search/redirect endpoint. This is a classic new-tab/search hijacker pattern: the stated purpose ('Media Tab New Tab') is a blank page that exists only to funnel all new-tab traffic through the operator's monetized redirect URL.

let redirect = __webpack_require__(24);var settings = {  title: "Media Tab",  url: "https://www.mediatab.club/sapi/rd.html?hn=mediatab.club&src=dsmedia"};new redirect.redirect(settings);...module.exports.redirect = function(settings) {  function redirect() {    let meta = document.createElement('meta');    meta.httpEquiv = "refresh";    let url = settings.url;    meta.content = "0;URL=" + url;    document.getElementsByTagName('head')[0].appendChild(meta);  }  redirect();};

The extension's declared new tab page is an empty HTML document whose only purpose is to load script_release.js, which immediately meta-refreshes the browser off-extension to mediatab.club. None of the UI promised by the extension description ('Media Tab New Tab') is actually rendered — the page exists solely as a launcher for the redirect hijack.

< !DOCTYPE html>  < html lang="en">    < head>      < meta charset="UTF-8">        < script src="/release/script_release.js">          < /script>            < /head>              < body>                < /body>                  < /html>

On install, the service worker fires a tracking pixel to mediatab.club/pixel/install with source attribution parameters (src=sdmedia, ssrc=nt), and registers an uninstall URL that loads mediatab.club/remove.html when the user removes the extension. This is covert install/uninstall telemetry and attribution tracking done without user consent and outside of any privacy disclosure.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason === "install") {    fetch('https://www.mediatab.club/pixel/install?src=sdmedia&ssrc=nt', {      mode: 'cors'    });    chrome.tabs.create({      url: "pages/index.html"    });  }});let removeUrl = "https://www.mediatab.club/remove.html";if (chrome.runtime.setUninstallURL)  chrome.runtime.setUninstallURL(removeUrl);

The content script (injected on mediatab.club pages) listens to postMessage events of type 'DA' from the page and forwards an arbitrary 'action' string to the extension's background service worker. This creates a web-page-to-extension bridge that lets the operator's site instruct the extension at runtime; although the current background handler is empty, the bridge is a remote-control channel that could be weaponized by a page update without shipping a new extension version.

window.addEventListener("message", function(event) {  if (event.source !== window)    return;  if (event.data.type && (event.data.type == "DA")) {    chrome.runtime.sendMessage({      from: 'content',      subject: event.data.action    });  }});