Ultimate New Tab Page - AI Search & Dial

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension Ultimate New Tab Page - AI Search & Dial (version 0.5.0) from developer Dracon presents as a new tab replacement with AI search features. The manifest declares no permissions and no host permissions, which limits its theoretical reach. However, the network_endpoints list contains dozens of suspicious-looking domains following a pattern of subdomain prefixes like "0---" and "0-0-" attached to domains such as supertms.com, canva-apps.cn, and manulife-sinochem.com. These resemble generated test domains or placeholder values rather than legitimate API endpoints.

The scanner produced 99,180 total findings, but the breakdown reveals the nature of the noise. The findings_summary shows 99,117 IoC findings and 56 code-smell findings, with zero malware signatures, zero malware matches, and zero obfuscation findings. The seven network findings all point to chunk files in the build output: chunks/SearchSourceToggles-BGHf6nKQ.js, chunks/SearchSuggestions-mwZvoVta.js, chunks/results-BlGlzKTJ.js (four separate locations), and chunks/taste-BjQcbucX.js. These are webpack/bundler output files where the IoC extractor has flagged string fragments that resemble URLs or IPs. The code-smell findings are YARA rules that trigger on common JavaScript patterns like fetch, axios, and environment variable access — patterns present in any modern bundled extension.

A skeptic would note the sheer volume of findings and the odd network endpoints as red flags. The volume is explained by known scanner behavior: the IoC extractor produces false positives on minified code fragments, IPv6-like hex strings, and property access chains (b.call, h.next). The endpoints follow a synthetic pattern inconsistent with real tracking infrastructure. No credential theft, browser hijack, or proxyware indicators appear. The extension has zero users and no established publisher reputation, but the technical findings do not support malicious function.

Key Reasons

• 99,117 IoC findings are extractor false positives on minified bundles
• 56 code-smell findings are generic YARA rules on common JS patterns
• Zero malware signatures or obfuscation findings
• Manifest declares no permissions or host permissions
• Network endpoints follow synthetic test-data pattern

False Positive Considerations

• IoC extractor garbage on bundled chunks
• YARA code-smell rules on minified JavaScript
• Synthetic network endpoint patterns
• High finding count from known noise sources

Reviewed 2026-09-29; recommended action: suppress false positive; model confidence 82%.