Extenshiextenshi.io/blog
Back to articles
privacybrowser-extensionspermissionsnew-tabtopsiteschrome-extensions

New tab overrides explained: what an extension that replaces your new tab can really see

Replacing your new tab page takes no permission at all. Here's what a new tab override extension can really see, when it's fine, and how to check yours.

Maxim Kosterin
9 min read
A blank page of hairline tiles on paper with an orange watercolor wash soaking up from the bottom edge until the lowest row is drowned — a new tab page taken over from underneath.
A blank page of hairline tiles on paper with an orange watercolor wash soaking up from the bottom edge until the lowest row is drowned — a new tab page taken over from underneath.

Open a new tab. Something loaded. If an extension owns that page, the thing that loaded is code written by whoever published the extension — and it got there without asking for a single permission.

That's the part that catches people out. New tab replacement is one of the most crowded extension categories on any store, and the mechanism behind it isn't a permission you can weigh up at install time. It's a manifest key. It never appears in the "This extension can…" list, because it isn't in that list at all.

So here's what that page can actually do, when it's fine, and how to work out which extension is sitting on your new tab right now.

What a new tab override actually is

Chrome lets an extension replace three of its built-in pages through a manifest key called chrome_url_overrides: the bookmark manager, the history page, and the new tab. Per the Chrome docs on overriding Chrome pages, each extension can only override one of them — so an extension that takes your new tab can't also take your history page.

The replacement is a plain HTML file shipped inside the extension. Hit Ctrl+T and Chrome loads chrome-extension://<id>/newtab.html instead of its own page.

Two constraints are worth knowing. Overrides don't apply to New Tab pages in incognito windows — Chrome blocks that outright. And the docs push authors to keep the page small and fast, because users expect a built-in page to open instantly.

Firefox supports the same key, documented on MDN as chrome_url_overrides, though the set of overridable pages isn't identical.

What it actually allows

The override page is an extension page. That matters more than it sounds.

A content script runs inside a website's tab, in an isolated world, with a deliberately narrow slice of the extension APIs. An override page runs on the extension's own origin with the extension's full API surface — whatever the manifest declared, this page can call.

And it runs every single time you open a tab. That's a behavioral stream on its own, before any permission enters the picture: how many tabs you open, at what hours, in what bursts. The page can make network requests like any other page, so "one ping per new tab" is a design choice available to the author, and nothing in the permission list would hint at it.

Then come the permissions that make the page useful — and revealing.

topSites

chrome.topSites.get() returns your most-visited sites: the same list Chrome uses to build its own tile grid. It needs the topSites permission, and per the Chrome topSites reference, each entry carries only a title and a url. No visit counts, no timestamps, and Chrome excludes the shortcuts you customized yourself. Firefox exposes a broader version of the same API with extra filtering options.

So it's narrower than it could be. It's still a ranked list of the handful of places where you spend your life — which for most people includes an employer's internal tools, a bank, and a couple of things you'd rather not have to explain.

history

Some dashboards add a "recently visited" strip. That needs the history permission and the chrome.history API, which is a far bigger ask: the full, searchable, retroactive log, including sites you visited long before the extension existed on your machine. I broke that down in the history permission piece — the short version is that it reads backwards, and browser sync means it can surface pages you only ever opened on your phone.

A new tab dashboard asking for history to power a recents row is trading a large chunk of your past for a small feature. That's a fair trade to refuse.

favicon, and the leak nobody looks for

Site tiles need icons. The clean way is Chrome's own _favicon/ path with the favicon permission, documented here — the browser serves an icon it already has, and nothing leaves your machine.

The lazy way is hotlinking a third-party favicon service — a URL shaped like icon-api.example/icon?domain=yourbank.com. Do that and every new tab you open ships your most-visited domains to a server you've never heard of, as an ordinary HTTP request with your IP attached. No permission covers this. It's an image tag.

One more wrinkle straight from the Chrome docs: the favicon permission only triggers a warning if the extension hasn't already requested tabs or host permissions. If it has, favicon slides in without a word.

The search-engine cousin

A separate manifest key, chrome_settings_overrides — MDN documents the cross-browser version here — changes your default search engine. Different mechanism, same neighborhood, worse consequences: every query you type into the address bar routes through whoever the extension points at. New tab and search takeovers usually travel together.

Why this category attracts trouble

Because it's valuable real estate that costs nothing to claim.

BleepingComputer reported on August 2, 2026 that Google is building a Chrome protection which would, by default, block policy-installed extensions from hijacking the new tab page or the default search engine. The mechanism being abused is enterprise policy: force-install keys meant for managed corporate fleets can also be written locally by malware on an unmanaged personal PC, planting a new tab hijacker without the user ever visiting the Chrome Web Store.

Google engineer Anunoy Ghosh put it plainly in the Chromium change quoted by BleepingComputer: "In low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers."

Be precise about the status, though: this was spotted in work-in-progress Chromium changes and had not shipped as of that reporting. Until it does, the technique still works on consumer machines.

The legitimate end of the category has its own issues. LayerX Security's research into extensions that disclose data sales identified Dashy New Tab as carrying a "does not sell your data" designation on its Chrome Web Store listing while its linked privacy policy stated "Sold or Shared: Yes." I went into that mismatch in my piece on extension privacy policies; as of that reporting, the developer had not publicly responded to the findings.

When it's fine, and when it isn't

Fine:

  • the new tab is the product — a dashboard, a bookmark grid, a focus timer
  • it asks for topSites and nothing else, or asks for nothing at all
  • icons come from _favicon/ rather than a third-party icon API
  • there's a setting that hands Chrome's page back without uninstalling

Pause:

  • the extension's actual job has nothing to do with new tabs — a coupon finder, a PDF converter, a video downloader — and it took the page anyway
  • a new tab override plus history
  • a new tab override plus broad host permissions. As of the 2026-06-01 Extenshi catalog snapshot, only 7.4% of live listings request <all_urls>, so it's an unusual thing to find stacked on top of a page takeover
  • your default search engine changed at the same time
  • you don't remember installing it, and chrome://extensions says "Installed by enterprise policy" on a personal machine

How to check yours

  1. Open a new tab. If it isn't Chrome's own page, right-click → Inspect. The URL shown in DevTools starts with chrome-extension:// followed by the extension's ID. That's your fingerprint.
  2. Keep DevTools open on the Network tab and reload the new tab. Every request the page fires on load shows up there — third-party favicon services and analytics beacons are obvious within a second.
  3. Paste the ID into chrome://extensions, click Details, and read the permissions. topSites alone is proportionate. history, or "Read and change all your data on all websites", on a new tab extension is not.
  4. On that same page, look for an "Installed by enterprise policy" label. On a personal machine, that's the route Google is working to close — treat it as a red flag rather than a formality.
  5. Look the extension up in the catalog to compare its declared permissions and scanner findings against similar extensions.

One honest caveat to carry through all of it: a declared permission is a statement of capability, not proof of behavior. I dug into that gap in runtime tracking versus permissions. The manifest tells you what an extension could do on every tab you open. It doesn't tell you what it does.

Check your permissions

If you've been running the same new tab dashboard for two years without thinking about it, that's the one to look at first. Pull up its permissions, watch what its page requests on load, and decide whether the tiles are worth it.

Check your permissions →

Sources

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If any entity referenced in this article believes information is inaccurate, contact [email protected] and we will review and update.

Related Articles