Security Alert: Malware Risk Confirmed
New Tabber — Custom New Tab + AI Chat
ID: akcnockgfioknlkmdfmiainbjgfocgdh
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- newtabber.comView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Customizable new tab with tiles, folders, dock, Liquid Glass UI, and an AI Chat sidebar (OpenAI, Anthropic, Gemini).
New Tabber - Productive New Tab Transform your new tab experience with New Tabber, a Chrome extension designed to boost productivity. This is an ongoing product with various features are under development. - Customizable UI with beautiful Backdrop Blur. - Dark and Light mode is automatically set based on background dominant color. - Customizable backgrounds - can be uploaded or fetched from Unsplash. - Ability to add/delete bookmarks. Bookmarks can be arranged by your choice. - Search bar with suggested queries from Google - Synchronize settings across devices both automatically and manually
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://generativelanguage.googleapis.com/*
The installed bundle (v1.4.1) declares a permission set entirely different from what the CWS listing reports: the bundle adds `search` (absent in CWS), drops `identity` (present in CWS), and substitutes AI-API host_permissions for OpenAI/Anthropic/Gemini in place of the CWS-listed Google/Unsplash/gstatic origins. If Google's extension review did not re-evaluate these permission changes, the extension effectively gained undisclosed network access; this is compounded by chrome-stats reporting the extension as 'removed from store', which may indicate Google subsequently flagged and pulled it. The stated AI Chat feature justifies AI-API access in principle, but the absence of these permissions from the CWS disclosure is the concern.
// BUNDLED manifest.json (version 1.4.1)"permissions": ["storage", "search"],"host_permissions": [ "https://api.openai.com/*", "https://api.anthropic.com/*", "https://generativelanguage.googleapis.com/*"],"web_accessible_resources": [{ "resources": ["*.js","*.css","*.png","*.svg","*.jpg","*.woff2"], "matches": ["<all_urls>"]}]// PUBLISHED CWS manifest (snapshot)"permissions": ["storage", "identity"],"host_permissions": [ "https://suggestqueries.google.com/", "https://unsplash.com/", "https://*.unsplash.com/", "https://www.google.com/", "https://*.gstatic.com/"],"web_accessible_resources": [{ "resources": ["*.js","*.css","*.svg","logo-128.png","john-fowler-RsRTIofe0HE-unsplash.jpg"], "matches": ["*://*/*"]}]By severity
Versions scanned
None of the 8 scanned versions have more than one unique code-review finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| No versions with multiple unique findings. | |
Files with findings
1 distinct path — top paths by unique finding count:
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.