Is Best Sports News safe?
We analyzed Best Sports News version 1.3's actual code and gave it a 58/100 trust score. This is a sports-news new-tab extension with moderate privacy and…
Bottom line
This is a sports-news new-tab extension with moderate privacy and design concerns, mainly because it collects search typing and routes searches through commercial services.
What it can access
It replaces new tabs and sends text typed into its own search box to sports-search services, which partly fits its purpose but is broader than the description says. [Q1][Q3][Q9][Q15]
Security weaknesses
Remote content and server-provided suggestions can alter the new-tab display, creating a risk if those sources are compromised or become unsafe. [Q7][Q16][Q20]
Signs of misuse
The extension sends live search typing to outside services and routes searches through a commercial provider, with disclosed advertising and partner measurement. [Q6][Q9][Q15][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The package has little conventional browser access: it can contact get-sports-news.com and expose packaged icons, but it cannot inspect ordinary tabs. Its consequential access comes from replacing the new-tab page and collecting input in that extension-owned page.
Overrides the new tab, grants only get-sports-news.com host access and declares no content script or ordinary browser-data permission. — manifest.json:4-26
The replacement page consists mainly of a search box and remote sports iframe. — index.html:40-60
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines a new-tab override but no content_scripts and only a narrow get-sports-news.com host pattern. — manifest.json:4-26
Queries and updates elements belonging to index.html, not page tabs. — index.js:10-207
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Anything typed into the new-tab search box is sent as the user types, so sensitive search text could be exposed before submission. The input source is the visible extension search field; the sinks are suggest.findit-all.com on keyup and search.get-sports-news.com on submit.
The keyup handler appends the full current input value to the suggestion URL and fetches it. — index.js:81-109, 181
Submit or Enter navigates to search.get-sports-news.com with the search text in the q query parameter. — index.js:15-32
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension code does not access Chrome cookies, sessions, history, bookmarks or downloads. The search and iframe services can use normal web cookies, IP addresses and referrers; the bundled policy explicitly describes cookie IDs, install IDs, URLs and search-term retention, but the package does not reveal the servers' exact implementation.
Declares no cookies, history, bookmarks or downloads permission. — manifest.json:4-26
Discloses IP address, install ID, cookie ID, referrer, search terms, partner sharing and retention. — pages/privacy-policy.html:35-60
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Contains none of the relevant device or native-integration permissions. — manifest.json:4-26
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends live search prefixes to suggest.findit-all.com for suggestions and submitted queries to search.get-sports-news.com for results. Every new tab also contacts an Amazon S3 sports iframe and CDN stylesheet/font providers.
Defines the suggestion endpoint, sends the current input on keyup and redirects submitted searches with q and campaign tid parameters. — index.js:1-20, 81-109
Loads CDN styles and an S3-hosted iframe in the replacement page. — index.html:6-7, 55-67
Discloses collection, sharing and retention of search-service identifiers and queries. — pages/privacy-policy.html:38-60
Does it download or run code, settings, or instructions supplied by a remote server?
It does not download JavaScript for extension-privileged execution. However, it downloads suggestions that are treated as raw markup and embeds a remotely hosted iframe, so servers can change visible new-tab content and links after review.
Fetches server-controlled suggestion JSON and passes its strings to renderSuggestions. — index.js:81-109
Embeds a mutable S3 document as the sports-news area. — index.html:55-60
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Remote iframe and stylesheet requests occur automatically whenever a new tab opens, and suggestion requests occur on each nonempty keyup rather than only after search submission. The new-tab override is consented to through Chrome's installation permission, but there is no in-page toggle or opt-out other than uninstalling.
Makes index.html the automatic new-tab page. — manifest.json:4-6
Registers autoSuggest on keyup and fetches for every nonempty input value. — index.js:81-109, 181
Remote resources are part of initial page markup. — index.html:6-7, 60-67
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces Chrome's new-tab page with its own search and sports interface. This is an explicit manifest feature and Chrome provides installation-level disclosure, but the extension's name and description do not state that it will replace new tabs or route searches through a commercial provider.
chrome_url_overrides maps newtab to index.html while the description only promises sports-news access. — manifest.json:4-19
Routes searches to search.get-sports-news.com with campaign ID 956880. — index.js:15-20
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Shows a 6 KB index.js and 158 KB stylesheet in a roughly 309 KB unpacked package. — inventory.json:1-100
Readable source directly identifies its endpoints and behaviors. — index.js:1-207
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains only a function-callback setTimeout and no dynamic JavaScript compiler. — index.js:1-207
Manifest V3 supplies the minimum extension-page CSP because no custom CSP is declared. — manifest.json:1-27
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, webNavigation, content script or broad host access exists. — manifest.json:4-26
Policy describes broad usage information, but reviewed code supplies no source for ordinary browsing activity. — pages/privacy-policy.html:29-35
Does it create a persistent ID or browser fingerprint to recognize you?
The package itself does not generate a per-user identifier. The search URL contains a fixed campaign ID, while the privacy policy states that the service collects cookie IDs and install IDs and retains them for business measurement.
Uses fixed identifiers RD1002988 and tid=956880 rather than generating a local random user ID. — index.js:1-20
States that cookie ID and install ID are collected and retained for up to 24 months. — pages/privacy-policy.html:38-60
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission or website-reading path is declared. — manifest.json:4-26
Network inputs originate only from the extension's own search field. — index.js:10-20, 81-109
Does it record typing, form entries, clipboard contents, or screenshots?
It records typing in its own search field through keyup events and sends the current value to the suggestion services after every nonempty edit. It cannot monitor typing on websites and does not capture forms, clipboard contents or screenshots.
autoSuggest reads e.target.value and fetches suggestions on every registered keyup. — index.js:81-109, 181
No content script, clipboard-read, tab-capture or desktop-capture capability is present. — manifest.json:4-26
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Suggestion JSON flows from fetch to items and then into b.innerHTML and an unescaped input value attribute. — index.js:56-75, 81-109
Loads an unsandboxed remote S3 document in the sports-content iframe. — index.html:55-60
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It replaces the normal new-tab experience and routes searches through get-sports-news.com using a campaign ID. The bundled policy identifies CodeFuel and search partners, discloses advertising/search monitoring and provides privacy/opt-out information, so this is invasive-but-disclosed monetization rather than demonstrated hidden referral fraud.
Searches navigate through the branded search endpoint with tid=956880. — index.js:15-20
Discloses search partners, query sharing, fraud/lifetime-value measurement, advertising monitoring and CodeFuel involvement. — pages/privacy-policy.html:49-60, 72-78, 133-134
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permissions are declared. — manifest.json:4-26
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Host access is limited to get-sports-news.com and no nativeMessaging permission is present. — manifest.json:4-26
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches suggestion JSON, slices data[1] and concatenates each untrusted item into innerHTML and an HTML attribute. — index.js:56-75, 99-109
No weakened extension_pages CSP is declared. — manifest.json:1-27
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes only icons/*.svg and declares no externally_connectable entry. — manifest.json:20-26
Lists only PNG icons; no SVG resource matching the declared pattern is packaged. — inventory.json:36-96
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Contains fixed endpoints and unconditional event registration with no cohort or activation condition. — index.js:1-207
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Implements only search, suggestion and UI toggling logic. — index.js:1-207
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines the extension-owned search form. — index.html:40-49
Handles its own form redirect and inserts remote suggestions only into its own suggestion container. — index.js:15-32, 56-75