Is Infinity New Tab (Pro) safe?
We analyzed Infinity New Tab (Pro) version 11.0.41's actual code and gave it a 74/100 trust score. A legitimate new-tab tool with broad optional access…
Bottom line
A legitimate new-tab tool with broad optional access and one meaningful login-message security weakness.
What it can access
The new-tab, search, storage, and optional browsing features fit its purpose, but approved options can expose history, bookmarks, Gmail, all websites, and installed extensions.[Q1]
Security weaknesses
The login flow accepts a message without checking its sender, although exploiting this appears to require a related login window.[Q16][Q21]
Signs of misuse
It sends account details and user-created feature data to its service for sync, while no unrelated page-input collection was found.[Q6][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It always has new-tab, search, storage, offscreen, background, and active-tab capabilities, and can optionally request history, bookmarks, top sites, Gmail, installed-extension management, notifications, favicons, or all-site access. Most optional powers map to visible features but create substantial access if enabled.
Declares activeTab, storage, unlimitedStorage, offscreen, background, and search plus optional history, bookmarks, topSites, management, Gmail, and <all_urls> access. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines a new-tab override and service worker but no content_scripts entry; broad website access is optional. — manifest.json:1
Requests host access while adding a custom shortcut so the extension can fetch the selected site's title or icon. — 14.js:8030-8100
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads information typed into its own pages, including account credentials, search terms, notes, tasks, AI prompts, and other content the user chooses to store or submit. It does not observe form entries on unrelated webpages.
Implements Infinity account login/profile state and cloud-backed user data. — 14.js:1300-1420
Implements user-created notes and note-content migration/storage. — 14.js:8600-8690
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
With separate user approval it can read or change bookmarks, inspect top sites and recent history, and enumerate or manage installed extensions. No cookie permission is requested.
Lists bookmarks, topSites, history, and management as optional permissions. — manifest.json:1
Contains bookmark-tree, top-sites, history/extension-manager feature logic and chrome.management.getAll usage. — 14.js:2315-2380,4430-4460,7200-7260
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can enumerate installed extensions if the user enables its extension manager and can upload images or documents the user selects for wallpapers, icons, notes, or AI features. No camera, microphone, clipboard, native messaging, or arbitrary local-file scan was found.
Uses chrome.management.getAll after optional permission is granted. — 14.js:7200-7260
Handles user-selected image/icon assets and uploads them for extension features. — 14.js:7640-7700
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Cloud sync sends account details, shortcuts, search choices, settings, tasks, notes and their images, and wallpaper data to Infinity. Search queries and AI prompts or documents go to the selected search provider or Infinity AI service as those features require.
Collects the feature stores used by backup and account synchronization. — 14.js:1980-2070
The bundled privacy text describes identifiable account and synchronized shortcut, search, location, task, note, image, wallpaper, and settings data. — _locales/en_US/messages.json:1
Does it download or run code, settings, or instructions supplied by a remote server?
Remote services supply synchronized settings and content, icon/search recommendations, wallpapers, weather, account status, and AI service data that influence the new-tab page. No remote executable code was found.
Defines Infinity API endpoints and structured account, sync, weather, and product-data requests. — 22.js:1
Restores server-supplied state into the extension's feature stores. — 14.js:1980-2070
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Its service worker and new-tab page automatically request product, account, sync, weather, and update data as relevant. Sensitive optional browser powers still require user approval and no automatic all-page collection was found.
Registers a persistent extension service worker and replaces every new tab with the packaged application. — manifest.json:1
Implements background initialization, API requests, alarms, and extension lifecycle work. — serviceworker.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces Chrome's new-tab page and provides the search box used there. Search is submitted only after the user enters a query, and no proxy, privacy-setting, or browser-default-search modification was found.
Declares newtab/index.html as the chrome_url_overrides new-tab page and requests the search permission. — manifest.json:1
Sends user-submitted queries through chrome.search.query or the explicitly selected search-engine URL. — 14.js:3840-3905
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is packed into large production-minified Webpack bundles with little source structure, making independent inspection substantially harder. The packaging looks like normal production bundling rather than deliberate concealment.
A multi-megabyte-equivalent minified bundle combines account, search, sync, permissions, privacy, notes, and UI code with dependencies. — 14.js:1-12233
Records numerous numbered chunks and minified service-worker, popup, new-tab, and AI application bundles. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
It contains actual eval() and new Function() execution. The traced calls recreate bundled image-compression worker functions, compile packaged framework templates, or implement compatibility/debug helpers; none receives fetched JavaScript.
The packaged browser-image-compression worker serializer marks bundled functions as strings and recreates those marked values with eval(). — 14.js:2137
The packaged Vue runtime compiler creates render functions with new Function using locally compiled template code. — chatai/assets/js/39c31d31.js:1
Does it track the websites, pages, searches, or links you visit?
It stores and syncs the user's shortcuts, selected search engines, weather location, tasks, notes, wallpapers, settings, and account state. If history or top-sites features are enabled, it also reads recent browsing activity for display.
Privacy disclosures enumerate synchronized account, shortcut, search, weather, task, note, wallpaper, and settings data. — _locales/en_US/messages.json:1
Reads top sites and persists the resulting list in local storage for the feature. — 14.js:4430-4460
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The analytics getPermission function starts with false and only assigns false before returning, preventing its sendEvent transport from proceeding. — 14.js:85
Presents optional anonymous analytics consent and describes the categories the dormant module could collect. — 14.js:12190-12233
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends Infinity account credentials during login, stores account access and refresh tokens, and synchronizes user-created content to Infinity. It does not have cookie permission or read authentication data from unrelated websites.
Implements account login, user state, access-token and refresh-token handling, and third-party login completion. — 14.js:1300-1420
Defines HTTPS API clients for account and synchronization operations at Infinity-controlled services. — 22.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests no clipboardRead or desktopCapture permission and defines no content script for observing page input. — manifest.json:1
Can a website or remote server send commands that make the extension take actions?
Infinity servers can change synchronized content and recommendations, while an opened third-party-login window can send a login result into the extension. The login message is trusted without verifying its origin or source.
Opens an Infinity login popup, listens for window messages with key login or bind, and processes them without checking event.origin or event.source. — 14.js:1300-1420
Applies structured state received through the synchronization APIs. — 14.js:1980-2070
Does it alter links, referral codes, advertisements, shopping carts, or search results?
Some built-in search URLs carry Infinity attribution or partner parameters, and the new-tab page discloses participation in the eBay Partner Network. It does not rewrite links or inject advertisements into ordinary webpages.
Built-in Baidu, Google, Bing, Yahoo, and other search definitions include product, source, or partner parameters. — 7.js:1
Displays that Infinity earns from qualifying purchases as an eBay Partner Network affiliate. — 14.js:4416-4424
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, downloads, or privacy permission. — manifest.json:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission or local companion integration. — manifest.json:1
Endpoint review found public Infinity, search, weather, mail, icon, and content services rather than localhost control paths. — inventory.json:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The eval path decodes only the image-compression helper's own BIC_FN-marked serialized bundled functions. — 14.js:2137
Webpack chunk loading resolves packaged extension paths rather than downloaded remote modules. — serviceworker.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
The extension's third-party login flow accepts a window message without checking the sender and stores supplied login tokens. Ordinary websites cannot normally load the private extension page, so exploitation requires a reachable window relationship such as the active login popup flow.
The message listener checks data.key but not event.origin or event.source before passing the message into login3rdSuccess and updating stored token state. — 14.js:1300-1420
Declares no externally_connectable entry and exposes only favicon assets as web-accessible resources, which limits direct website reachability. — manifest.json:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Contains locale- and provider-specific search definitions with differing destinations and attribution parameters. — 7.js:1
Remote synchronization and account state determine available and displayed user content. — 14.js:1980-2070
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Worker-style CPU work belongs to the visible browser-image-compression feature. — 14.js:2137
The offscreen and background capabilities support packaged new-tab application features; no native or mining component is declared. — manifest.json:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines no content script that could rewrite webpage form fields or actions. — manifest.json:1