Is ChartsTab - Live Crypto Prices & Charts safe?
We analyzed ChartsTab - Live Crypto Prices & Charts version 1.0.0.7's actual code and gave it a 55/100 trust score. This is a broad-access crypto…
Bottom line
This is a broad-access crypto dashboard with a dormant but concerning server-controlled redirection feature.
What it can access
It runs on every website and can replace the new-tab page, while storage and search support its dashboard but broad page access is excessive. [Q1][Q2][Q9]
Security weaknesses
Remote settings can activate full-page redirects and control page content or destinations without an extension update. [Q7][Q16][Q18]
Signs of misuse
The packaged monetization path could send visited addresses to a chosen destination, but the checked settings did not activate it. [Q12][Q17][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, search and all-URL access, replaces the new-tab page, and runs a page access everywhere. All-page access supports the advertised widget, but the same access also supports an unrelated remote redirect mechanism.
Declares the new-tab override, storage/search permissions, <all_urls> host access and an all-sites content script. — manifest.json:14-33
The file labels a separate Monetization section that can redirect the current page from remote settings. — content.js:487-560
Which websites can it run on, and can it read or change what appears on those pages?
It runs on every normal webpage, adds a floating crypto button and panel, and can replace the whole page with a remotely configured URL if the dormant redirect system is enabled. It does not otherwise read or rewrite page content.
Appends fixed widget styles, button and panel to document.documentElement. — content.js:17-201,271-295
A reachable gated path assigns a remotely constructed URL to window.location.href. — content.js:536-560
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads the extension-owned search box on a user action and uses chrome.search.query. — newtab.js:273-301
All-page code builds and moves the crypto widget but does not read host inputs or forms. — content.js:17-659
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Stores recent numeric tab IDs to detect tab deactivation; it does not query tab titles or URLs. — bg.js:14-31,134-140
Reads the current hostname and full URL only inside the gated redirect function. — content.js:549-560
Does not request cookies, history, bookmarks or downloads. — manifest.json:17-23
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests only storage and search plus all-URL host access. — manifest.json:17-23
Manual source searches found none of the relevant device or management APIs. — inventory.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Selected crypto symbols go to Binance for ticker, chart and exchange data. The extension fetches settings from chartstab.pro daily.
Fetches chartstab.pro configuration and Binance market data. — bg.js:1-10,68-79,163-205
Sends the hostname as dname and host parameters to config.tracking.checkUrl. — bg.js:94-107
Places hostname and the encoded full current URL in a navigation to config.tracking.redirectUrl. — content.js:536-560
The fetched configuration contains crypto settings and a thank-you URL but no tracking object. — live-config-2026-09-29.json:1-18
Does it download or run code, settings, or instructions supplied by a remote server?
A daily remote JSON controls crypto defaults, refresh timing, an install URL, new-tab HTML and optional hostname-check/redirect behavior. This is server-controlled instruction and page manipulation, not downloaded JavaScript.
Downloads and stores configuration from chartstab.pro every 24 hours. — bg.js:1-2,59-91
Opens config.chartstab.thank_you after installation. — bg.js:142-155
Inserts config.tracking.contentBlock directly into the new-tab info bar with innerHTML. — newtab.js:306-320
Current fetched data has no tracking settings and points thank_you to chartstab-install.pro. — live-config-2026-09-29.json:1-18
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically fetches configuration and Binance data, and opens a remotely chosen thank-you page after first install. A dormant server-controlled path can redirect a visited page after the user switches tabs, but its required settings were not active when checked.
Performs startup configuration/market requests and opens the configured install page. — bg.js:68-91,142-155,163-218
After configurable delays, a positive server check and tab deactivation can trigger full-page navigation. — content.js:497-560
No tracking.enabled, checkUrl or redirectUrl is currently present. — live-config-2026-09-29.json:1-18
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces Chrome's new-tab page and uses the search permission to submit the user's visible new-tab query to the configured default search engine. It does not change the default engine, proxy, homepage, privacy settings or other extensions.
Declares search and a new-tab override, but no settings, proxy or management permission. — manifest.json:17-26
Calls chrome.search.query only after the user clicks Search or presses Enter. — newtab.js:273-286
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Lists three small JavaScript files with ordinary source and no bundled/minified application blob. — inventory.json:1
The complete remote redirect flow is present in readable source. — content.js:487-560
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Manual fixed-string and call-site searches across all JavaScript found no text-to-code primitive. — inventory.json:1
Parses the remote response as JSON and stores it; it is not evaluated as code. — bg.js:68-79
Does it track the websites, pages, searches, or links you visit?
A complete browsing-data path is confirmed but currently dormant: all-page code reads each hostname, can send it to a remote checker, and can forward the full current URL to a redirect destination. The September 29 configuration omitted the tracking block, so active collection was not demonstrated.
Sends the visited hostname to a server-selected checkUrl when tracking is enabled. — bg.js:94-107
Reads hostname and full window.location.href, then encodes them as h and go in the configured redirect URL. — content.js:497-560
The current configuration has no tracking configuration, so initTracking returns before collecting or redirecting. — live-config-2026-09-29.json:1-18
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Defines local storage keys for UI/cache state, install date, recent tab IDs and per-host redirect delays. — bg.js:6,14-57,142-147
No UUID generator, hardware-signal collector or fingerprint library appears in the package. — inventory.json:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It does not access cookies, sessions, credentials or page contents. Its dormant redirect path can disclose the full current URL—including any sensitive path, query or fragment—to a server-selected destination.
Reads window.location.href and appends its encoded value as the go parameter to config.tracking.redirectUrl. — content.js:549-560
Does not request cookie access. — manifest.json:17-23
No redirectUrl is currently supplied. — live-config-2026-09-29.json:1-18
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Handles only the extension's own search and settings controls. — newtab.js:273-301
All-page code has drag/click listeners for its own widget and no host input, change, submit or key listener. — content.js:17-659
Can a website or remote server send commands that make the extension take actions?
The chartstab.pro configuration server can activate hostname checks and choose a redirect destination without an extension update. Packaged code then navigates the page after fixed gates.
Accepts server-controlled tracking settings and uses checkUrl to authorize a host. — bg.js:68-79,94-107
Applies install/per-host delays, requires a positive host check plus tab deactivation, then navigates to redirectUrl. — content.js:497-560
Current data does not activate the mechanism. — live-config-2026-09-29.json:1-18
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No packaged code directly rewrites links, referrals, ads, carts or search results. The hidden redirect is labeled monetization and could route visits through any server-selected URL, but no active destination or referral behavior was available in the checked configuration.
Labels the feature Monetization and builds the entire navigation target from remote redirectUrl plus h/go parameters. — content.js:487-560
No tracking.redirectUrl is currently present, so its destination and purpose cannot be observed. — live-config-2026-09-29.json:1-18
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It has a server-controlled full-page redirect path, although it does not intercept requests, alter headers, control downloads or set a proxy. The redirect mechanism was dormant in the checked live configuration.
Builds finalUrl from server configuration and assigns it to window.location.href. — content.js:536-560
Does not request webRequest, declarativeNetRequest, downloads or proxy. — manifest.json:17-23
No active redirect URL is supplied. — live-config-2026-09-29.json:1-18
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Defines only public HTTPS configuration and Binance endpoints. — bg.js:1-10
Does not request nativeMessaging. — manifest.json:17-23
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses response.json for the remote configuration. — bg.js:68-79
A remote contentBlock can reach innerHTML, but there is no decode-to-eval chain. — newtab.js:306-320
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable or web-accessible resource declaration. — manifest.json:1-34
Handles getConfig and checkHost internal runtime messages; no external message listener exists. — bg.js:113-132
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The redirect behavior depends on remote tracking.enabled/checkUrl/redirectUrl settings, an install delay, a per-host delay, a positive server response and tab deactivation. The checked configuration omitted the first gate, so the serious behavior was inactive at review time.
Implements every activation gate and the final redirect. — content.js:497-560
A server-selected host check must return the literal text true. — bg.js:94-107
No tracking object is present. — live-config-2026-09-29.json:1-18
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Fetches selected market data on configured intervals; no hashing or worker pool is present. — bg.js:161-243
Polls local widget state and renders cached prices. — content.js:601-650
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines the extension-owned search and asset settings controls. — newtab.html:14-21,37-53
Creates only widget controls and has no host form or action mutation path. — content.js:17-659