[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

New Tab by Yahoo

Version 3.0.7 View in Chrome Web Store

Last scanned: about 10 hours ago

Extension Details

Developer: YAHOO INC.

Rating: 4.1 ★ (14 ratings)

Users: 10,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: *://*.yahoo.com/. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
topSites
cookies
storage
alarms

Host Permissions:

*://*.yahoo.com/

Embedded URLs (127 total):

https://sxh.yimg.com/jf/flickr-assets/json/o_flickr_page_	https://sxh.yimg.com/jf/flickr-assets/photos/
https://search.yahoo.com/trending/us_general.json	https://data.search.yahoo.com/data/v3/search?appid=f2901894&query=dummy&market=en-US&features=trending.now
http://www.befrugal.com/lp/yahoo	https://query.yahooapis.com/v1/public/yql?q=
https://search.yahoo.com/jf/ext/conf/newtab/	https://6824905.fls.doubleclick.net/activityi
https://policies.yahoo.com/us/en/yahoo/privacy/index.htm	https://policies.yahoo.com/us/en/yahoo/terms/utos/index.htm
https://yahoo.mydashboard.oath.com/	https://partner-query.finance.yahoo.com/v6/finance/quote/?symbols=
https://partner-query.finance.yahoo.com/v6/finance/basicQuote/?symbols=	http://finance-yql.v1.production.manhattan.gq1.yahoo.com/v1/finance/trending/us?debug=true
https://partner-query.finance.yahoo.com/ws/newsfeed/v2/finance/partner/quotefeeds?count=20&symbols=	https://finance.mobile.yahoo.com/dp/v2/newsfeed?category=generalnews&count=20
https://partner-query.finance.yahoo.com/v6/finance/autocomplete?query=	https://partner-query.finance.yahoo.com/v6/finance/portfolio
https://partner-query.finance.yahoo.com/v1/test/getcrumb	https://feeds.contenthub.aol.com/syndication/2.0/feed/662c379bd2587
https://feeds.contenthub.aol.com/syndication/2.0/feed/662c35a835e1c	https://feeds.contenthub.aol.com/syndication/2.0/feed/662c38c0c3561
https://downloads.yahoo.com/goodbye	https://sports.yahoo.com
https://api-secure.sports.yahoo.com/v1/editorial/s/trending_game_ids?trending_config=new_tab&ysp_new_tab=1	https://api-secure.sports.yahoo.com/v1/editorial/s/scoreboard?lang=en-US&region=US&tz=America%2FLos_Angeles&ysp_redesign=1&leagues=
https://api-secure.sports.yahoo.com/v1/editorial/league/	https://sports.yahoo.com/
https://api-secure.sports.yahoo.com/v1/editorial/team/	https://api-secure.sports.yahoo.com/v1/editorial/article_index
https://amazon.com	https://www.aol.com
https://bing.com	https://chrome.google.com
http://www.cnn.com	https://ebay.com
https://facebook.com	https://flickr.com
https://github.com	https://gmail.com
https://google.com	https://instagram.com
https://linkedin.com	https://msn.com
https://netflix.com	https://pandora.com
https://spotify.com	https://tumblr.com
https://twitter.com	https://www.verizonwireless.com
https://wellsfargo.com	https://yahoo.com
https://mail.yahoo.com	https://youtube.com
https://www.tumblr.com	https://www.amazon.com
https://www.facebook.com	https://www.wikipedia.org
https://www.walmart.com	https://mail.aol.com
https://finance.yahoo.com	https://www.engadget.com
https://www.techcrunch.com	https://clients2.google.com/service/update2/crx
https://fonts.googleapis.com/css?family=Roboto:400	https://fonts.googleapis.com/css?family=Raleway:200
https://www.yahoo.com/news/weather/	https://flickr.com/photos/
https://downloads.yahoo.com	https://geo.yahoo.com/t
https://geo.yahoo.com/	https://search.aol.com/aol/search?q=
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	https://fonts.googleapis.com/css?family=Roboto:100
https://github.com/ForbesLindesay/umd/blob/master/template.js	https://partner-query.finance.yahoo.com/v7/finance/quote/?symbols=
https://finance.yahoo.com/portfolio/	http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_newtab_chrome_extension_name__",
  "icons": {
    "128": "icons/Y_NT128.png"
  },
  "action": {
    "default_icon": {
      "64": "icons/Y_NT64.png"
    }
  },
  "version": "3.0.7",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_newtab_chrome_extension_description__",
  "permissions": [
    "tabs",
    "topSites",
    "cookies",
    "storage",
    "alarms"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "notifyPresence.js"
      ],
      "matches": [
        "*://*.yahoo.com/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "*://*.yahoo.com/"
  ],
  "manifest_version": 3,
  "chrome_url_overrides": {
    "newtab": "newtab.html"
  }
}

by ✦ Astarte

New Tab by Yahoo

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (127 total):

Raw Manifest

Detections

Manifest Findings