Is Empty New Tab Page safe?
We analyzed Empty New Tab Page version 1.3.0's actual code and gave it a 98/100 trust score. This is a narrowly scoped, local extension that matches its…
Bottom line
This is a narrowly scoped, local extension that matches its stated purpose and shows no evidence of misuse.
What it can access
It only replaces the new-tab page with a local blank page, matching its stated purpose and requesting no other access. [Q1]
Security weaknesses
The only automatic action is the disclosed new-tab replacement, with no evidence of broader browser control or exposed privileged features. [Q8][Q9][Q21]
Signs of misuse
No evidence shows tracking, data collection, remote code, or hidden behavior; the page is local and static. [Q6][Q7][Q10][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Declares only a new-tab override and no permissions, host permissions, or content scripts. — manifest.json:1-12
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content scripts or scripting access and maps newtab to empty_ntp.html. — manifest.json:4-11
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Contains only local CSS, comments, and a title. — empty_ntp.html:1-16
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares none of the browser-data permissions. — manifest.json:1-12
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no device or native-integration permissions. — manifest.json:1-12
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
References no remote resource and contains no script. — empty_ntp.html:1-16
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The replacement page is fully local and static. — empty_ntp.html:1-16
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Chrome automatically displays its blank local page when a new tab opens; no other automatic behavior exists.
Maps Chrome's newtab page to empty_ntp.html. — manifest.json:9-11
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces the new-tab page exactly as its name and description disclose.
Names and describes the blank new-tab behavior and declares the matching override. — manifest.json:5-11
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Lists only a manifest, static HTML page, icon, and store verification metadata. — inventory.json:1-32
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Lists no JavaScript files. — inventory.json:1-32
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares no history, tabs, webNavigation, or content-script access. — manifest.json:1-12
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no scripts, storage use, analytics, pixels, or remote resources. — empty_ntp.html:1-16
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no webpage or cookie access and contains no input-processing code. — manifest.json:1-12
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares none of the required permissions or scripts. — manifest.json:1-12
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The extension page is entirely static and local. — empty_ntp.html:1-16
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The only declared modification is the advertised new-tab replacement. — manifest.json:5-11
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no networking, proxy, request, or downloads permissions. — manifest.json:1-12
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no native or system permissions and no host access. — manifest.json:1-12
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains no JavaScript, iframe, remote stylesheet, image, or network reference. — empty_ntp.html:1-16
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, web-accessible resources, messaging worker, or externally_connectable entry. — manifest.json:1-12
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The sole behavior is the plainly described new-tab replacement. — manifest.json:5-11
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Lists no executable program files. — inventory.json:1-32
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Contains no form, input, or JavaScript. — empty_ntp.html:1-16