Is IE Tab safe?
We analyzed IE Tab version 19.3.5.1's actual code and gave it a 57/100 trust score. IE Tab appears purpose-aligned, but its broad website access, cookie…
Bottom line
IE Tab appears purpose-aligned, but its broad website access, cookie handling, native-helper control and remote-session features create significant exposure for an everyday browser user.
What it can access
It can operate across all websites, inspect cookies and browsing or download information, redirect selected activity, and communicate with an installed computer program [Q2][Q4][Q5][Q19]. These powers support displaying pages through IE and hosted sessions, but they are broad and can expose signed‑기
Signs of misuse
It transfers authentication-related cookies and active hosted-session data when those features are enabled, but this is tied to the stated compatibility and remote-session functions rather than shown as general theft [Q14][Q15]. No evidence establishes general visit tracking, downloaded-code control
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests broad access to websites, cookies, navigation and downloads, plus communication with an installed computer program; this supports its IE-compatibility purpose but is substantially more powerful than a typical page-display feature.
Requests access to all websites, cookies, tabs, web requests, blocking controls, native messaging, storage, alarms, offscreen operation, and optional downloads. — manifest.json:1
Runs a content component on all websites and another on ietab.net pages. — manifest.json:1
Reads and serializes cookies for the target website for transfer to the helper. — js/iecontainer.js:1070-1104
Communicates with and forwards data to an installed native helper. — js/nathost_manager.js:35-56,66-109,430-502
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: <all_urls> — manifest.json:1
Content scripts run directly on: *://*.ietab.net/*, <all_urls> — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension copies cookies, including HTTP-only cookies, into the IE/native-helper environment, but the reviewed code does not establish that it reads ordinary passwords, payment details, messages, or arbitrary form entries from normal webpages. Sensitive data may be handled inside the IE or hosted session, but that path is not fully verified.
Reads and serializes Chrome cookies for the target URL and sends them to the helper. — js/iecontainer.js:1070-1104
Stores, broadcasts, and restores session-cookie state. — js/cookies.js:10-71,101-163
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension can access cookies and broad tab, navigation, and download information. The reviewed code does not show direct bookmark access, and download access requires the optional downloads permission.
Requests cookies, tabs, webRequest, all-host access, and optional downloads permission. — manifest.json:57-74
Reads cookies for target URLs. — js/iecontainer.js:1070-1104
Searches, cancels, and erases matching downloads when downloads access exists. — js/background.js:517-564,777-800
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests access outside ordinary web pages: nativeMessaging.
The manifest requests: nativeMessaging — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends licensing and account-related data to IE Tab and Google-related services, and hosted mode routes remote-session traffic through vendor infrastructure. Depending on features used, cookies, keyboard input, display data, and proxied session traffic can leave the browser.
Performs license pings and validation exchanges involving identifiers, license state, and account information. — js/background.js:243-283,371-413
Uses vendor hub/token services and routes hosted-session traffic. — js/remhost_manager.js:22-35,262-332,632-644
Selects an external data service endpoint by region. — js/datacenter.js:68-70
Does it download or run code, settings, or instructions supplied by a remote server?
The extension can send a bundled native-helper payload and control messages to an installed native host, but the reviewed path does not establish that a remote server supplies executable code. Remote servers provide session or configuration data, not a demonstrated downloaded-and-executed program.
Sends the bundled helper payload and upgrade instructions to the native host. — js/nathost_manager.js:66-109,120-146
Initializes the native helper and performs version checks. — js/background.js:964-1009,1213-1243
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It can redirect or replace matching navigations, inspect startup tabs, and intercept matching downloads without a new click at that moment. Some actions depend on configured Auto URL rules, startup processing, or optional download permission.
Scans tabs, processes matching requests, and opens or replaces tabs. — js/background.js:606-632,663-725,1252-1266
Cancels or erases matching downloads and installs interception paths. — js/background.js:517-564,777-800,1300-1366
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the package includes a large binary native-helper payload and substantial third-party remote-session code. The extension-owned routing is readable, but those components are not equivalent to fully auditable source.
Large bundled native-helper payload is not ordinary readable source. — ietabhelper.dat:1-1
Large third-party remote-session transport component is bundled. — myrtille/network/websocket.js:1-1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence was found in the reviewed extension-owned behavior that it uses eval(), new Function(), or string-based timers to execute text as code. Large bundled or generated components leave a limited residual uncertainty.
Does it track the websites, pages, searches, or links you visit?
The extension observes URLs and navigation events to apply its configured interception rules and scans open tabs at startup. The reviewed code does not establish that it stores, correlates, or generally transmits a history of the websites, searches, or links you visit.
Processes matching request URLs and main-frame navigation events. — js/background.js:663-725,1300-1366
Scans open tabs and applies Auto URL behavior during startup. — js/background.js:606-632,1134-1180
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence shows a persistent user ID or browser fingerprint being created for tracking. Random values appear in license-related requests, but the available map does not show them being used as a recognition profile.
License ping includes a random value and extension-related identifiers; no browser-fingerprint construction is described. — js/background.js:243-283
Does it send cookies, session details, authentication data, or page contents elsewhere?
When cookie synchronization or hosted mode is used, the extension copies cookies and session data between Chrome, the IE/native helper, and sometimes remote-session infrastructure. This includes authentication-relevant cookies, but the transfer is tied to those features rather than shown as universal background exfiltration.
Reads and serializes cookies, including HTTP-only and secure attributes, for the target URL. — js/iecontainer.js:1070-1104
Stores, broadcasts, and restores session-cookie state. — js/cookies.js:10-71,101-163
Routes hosted hub and session traffic. — js/remhost_manager.js:262-332,632-644
Does it record typing, form entries, clipboard contents, or screenshots?
In hosted remote-desktop sessions, keyboard, clipboard, display, and related interaction data are transported as part of the remote session. This is not evidence of general keylogging or screenshot capture on ordinary webpages.
Handles keyboard events for the remote-session client. — myrtille/user/keyboard.js:1-137
Routes remote-host messages and proxy/session traffic. — js/remhost_manager.js:77-107,632-644
Can a website or remote server send commands that make the extension take actions?
A webpage can request IE Tab API actions after the applicable access check, while matching ietab.net pages receive an automatic bridge. The resulting actions can open supplied URLs and invoke exposed settings, storage, licensing, or native-helper workflows.
Enforces page API access state before forwarding requests. — js/ietabapi_cs.js:20-60,72-100
Handles access and opens supplied URLs without additional URL validation. — js/ietabapi_bp.js:27-49,142-164
Dispatches exposed settings, storage, license, and native-helper requests. — js/background.js:449-515
Does it alter links, referral codes, advertisements, shopping carts, or search results?
Configured Auto URL rules can change where matching navigations and downloads go, including replacing a download with IE-based navigation. No evidence shows manipulation of referral codes, advertisements, shopping carts, or search-result content.
Builds redirect rules from configured Auto URL and exclusion filters. — js/background.js:824-927
Cancels or erases matching downloads and opens the URL in IE Tab. — js/background.js:517-564,777-800
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It intercepts and redirects matching main-frame traffic, including special handling for POST and unsupported-filter cases, and can replace matching downloads. The reviewed code does not establish proxy-setting changes or general request-header rewriting.
Handles matching requests and installs DNR/webRequest interception paths. — js/background.js:663-725,824-927,1300-1366
Resolves pending URLs and navigates to the IE/native-host container. — js/redir.js:14-53
Can it communicate with software on the computer or services running on localhost?
The extension communicates with an installed native helper through Chrome native messaging and forwards container traffic and control data to it. This requires the native helper to be installed and the relevant IE Tab/native mode to run.
Builds the native-host manifest, connects to the helper, and sends upgrade/version messages. — js/nathost_manager.js:35-56,66-109
Forwards messages between container tabs and native ports. — js/nathost_manager.js:430-476,483-502
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension encodes, decodes, and serializes licensing, cookie, and native-helper data, and it can send a bundled helper payload to the native host. The reviewed source does not establish that hidden decoded data is executed or injected as code.
Sends bundled helper data during native-host upgrade. — js/nathost_manager.js:66-109
Performs licensing exchanges and processes returned licensing state. — js/background.js:243-283,371-413
Can ordinary websites access privileged extension features through messaging or exposed files?
Matching ietab.net pages receive a page-to-extension bridge, and other websites can use the public IE Tab API after approval. Exposed handlers can read or change selected settings and storage and trigger licensing, export, diagnostic, or native-helper operations.
Defines all-host content access, web-accessible bridge files, and ietab.net external connectivity. — manifest.json:34-47,66-77
Injects the page bridge and forwards same-origin page messages. — js/extapi_cs.js:34-65,80-90
Dispatches settings, storage, reset, license, dump, native, and export requests. — js/background.js:449-515
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Several behaviors activate only under configured or managed URL rules, license state, permissions, hosted-mode settings, cookie synchronization, or periodic policy refresh. The reviewed code shows conditional feature activation, not a covert date-triggered payload.
Startup scans tabs, applies Auto URL rules, processes downloads, and schedules policy refresh. — js/background.js:606-632,1134-1180
Settings and managed policy control URL filters and feature behavior. — js/settings.js:1-193
License state controls licensing behavior. — js/background.js:243-283,371-413
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence in the mapped extension-owned behavior indicates cryptocurrency mining or other covert resource-intensive work. Remote desktop rendering and networking are functional session components, not mining evidence.
Large remote-session networking code is present, but the mapped behavior identifies it as hosted RDP transport rather than mining. — myrtille/network.js:1-29489
Does it change form fields or where a form sends its information?
Matching form navigations can be redirected into the IE/native-host container, including POST navigation handling, so the destination context can change. The reviewed code does not show edits to individual form fields or arbitrary rewriting of form parameters.
Intercepts matching main-frame requests and applies Auto URL redirect/fallback logic, including POST paths. — js/background.js:663-725,824-927
Resolves the pending URL and navigates to the extension-owned container. — js/redir.js:14-53