Are New Tab Extensions Safe?

Are new tab extensions safe? Usually, yes. Millions of people use them every day without a problem. But an extension that replaces your new tab page is something you open dozens of times a day, and many can read the pages you visit. When one goes wrong, it can change your search engine, slip ads onto your page or collect your browsing history. This guide covers the real risks, a few cases where it actually happened, and a quick checklist for choosing an extension you can trust.

The short answer

Browser extensions are reviewed by Google, Microsoft and Mozilla, and the stores have strict rules. Chrome Web Store policy, for example, says extensions may not sell user data or pass it to “advertising platforms, data brokers, or other information resellers”. Most developers follow those rules. The problems come from a minority that make money in ways you can't see, change hands to a new owner, or get hacked. Reviews catch many of them, but not always before an update reaches your browser.

So the risk isn't new tab extensions as such. It's installing one without knowing who is behind it and how it pays for itself.

When a store steps in

Store reviews are not just a formality. One example from our own category: in November 2021 Mozilla removed the Firefox version of FVD Speed Dial, another visual speed dial extension. Mozilla’s add-ons team said the developer had been intercepting search queries sent to a third-party search provider, which its policies don’t allow. Mozilla had raised the same issue in 2020, the developer had switched the feature off, and it was later turned back on.

The block applied to the Firefox add-on in 2021. It is a good reminder that the stores do act on their rules, and that it is worth knowing how any extension you install handles your searches.

What can go wrong

Search hijacking

Some extensions change your search engine or send your searches through a partner, because searches can earn them money. When that happens without a clear choice on your part, it is usually called search hijacking.

Warning signs: your searches suddenly open on a different search engine, the address bar shows unfamiliar redirect pages, or the browser asks whether you want to keep a changed search setting.

Selling your browsing data

An extension that can read the sites you visit can also record them. In 2019, security researcher Sam Jadali documented a leak he called DataSpii: a handful of Chrome and Firefox extensions collected their users' browsing activity, and a data company then made it available to its paying members, down to private links and internal company pages. Store rules now forbid selling user data, but it still happens.

In December 2025, security company Koi reported that Urban VPN Proxy, a Chrome extension with Google's Featured badge, had started capturing users' conversations with AI chatbots such as ChatGPT, Claude and Gemini in an update released in July 2025. The collection was on by default, and Koi alleges the data was shared for marketing analytics through a company affiliated with the data broker BiScience. The only real protection is not giving broad access to extensions you don't trust.

Hidden affiliate codes

Affiliate links pay the extension a commission when you buy something. Disclosed, user-chosen affiliate links are allowed. The problem is undisclosed ones: extensions that rewrite links on the sites you visit, swap in their own codes, or fill your new tab with shopping tiles you never chose. In 2025 Google tightened its affiliate ads policy: since June 10, 2025, an extension may only apply affiliate links or codes after you take an action, with the program disclosed on its store listing, in its interface and before you install, and only when it gives you something in return, such as a discount or cashback.

Ads and sponsored tiles

Some new tab pages pay for themselves with sponsored tiles, a partner search box or news with ads. That isn't unsafe in itself when it's disclosed and can be switched off, but it does mean the page is working for someone besides you. Read the store listing: honest extensions say plainly how they make money.

New owners and malicious updates

Popular extensions get bought. A new owner inherits the users and the permissions, and the next automatic update can do something the old one never did. In 2020 the creator of The Great Suspender, a widely used tab manager, handed it over to a new maintainer whose identity was never made public. A later version loaded code from an unrelated third-party server, and in February 2021 Google removed it from the Chrome Web Store as malware (LWN's account).

Updates can also be hijacked without any sale. On December 24, 2024, attackers phished an employee of security company Cyberhaven, used the stolen Chrome Web Store access to publish a malicious version of its extension, and it reached users through automatic updates before the company replaced it (Cyberhaven's statement). The same campaign targeted other extension developers.

Some extensions are built to turn bad later. In July 2025 Koi found 18 Chrome and Edge extensions, several of them verified or featured in the stores, that started out clean and later received automatic updates that tracked the pages people visited and could redirect them. In December 2025 it described a campaign it called ShadyPanda, in which extensions that had behaved normally for years were updated in mid-2024 to download and run new code every hour. A store badge and a long, clean history are good signs, not guarantees.

More access than the job needs

Every extension lists its permissions before you install it. A new tab page doesn't need to read and change every site you visit just to show your bookmarks, so if it asks for that, look for a clear reason. Some features genuinely need it, such as taking a screenshot of a page for a tile, but a good developer explains what each permission is for.

How to tell if an extension is trustworthy

Run through this list before you install a new tab extension, or any extension:

1. 1
   Install only from the official store: the Chrome Web Store, Microsoft Edge Add-ons or addons.mozilla.org. Skip download sites, “installers” and pop-ups that offer an extension.
2. 2
   Check who makes it. Look for a named developer with a real website, a support address and a privacy policy. A product that has been around for years has more to lose.
3. 3
   Read the permissions. Each one should match a feature you want. Be cautious when an extension asks to change your search engine or read all your data without saying why.
4. 4
   Find out how it makes money. A paid plan, donations or a clearly disclosed sponsorship are all fine. If you can’t tell how a free extension pays its bills, your data or your searches may be the product.
5. 5
   Watch for a change of owner. A new publisher name on the store listing, a new company in the privacy policy, or a sudden wave of new features you didn’t ask for are worth a second look.
6. 6
   Read the recent reviews, not just the average. Look for mentions of ads, redirects, a changed search engine or tiles that appeared on their own.
7. 7
   Look it up. Koidex by Koi is a free lookup that shows a risk assessment for Chrome Web Store, Edge Add-ons and Firefox Add-ons extensions, along with recently caught malware.
8. 8
   Keep the number of extensions small. Every extension you remove is one less thing that can change with the next update.

Pro Tip: Open chrome://extensions or edge://extensions every few months and remove anything you no longer use. In Firefox the same list is at about:addons.

What to do if an extension misbehaves

If your search engine changed, ads appeared on your new tab or pages redirect somewhere you didn't expect, turn extensions off one by one until the problem stops, then remove the one that caused it. Reset your browser settings if the change keeps coming back. The steps for Chrome, Edge and Firefox are in New tab page changed? How to get yours back.

If an extension may have seen passwords or logged-in pages, change the passwords for your important accounts and sign out of other sessions. You can also report the extension from its store listing so reviewers take a look.

How Speed Dial 2 handles your data

We make Speed Dial 2, so here is exactly how it works, in the same terms we'd want from any extension:

• 15 years on the Chrome Web Store. Speed Dial 2 has been on the Chrome Web Store since 2011 and is also on Microsoft Edge Add-ons and addons.mozilla.org, with the same independent team behind it.
• No analytics or tracking code. Speed Dial 2 doesn't monitor, record or sell what you do.
• Your data stays in your browser. On the free plan your bookmarks and settings are stored locally. With Pro, they sync to your Speed Dial 2 account over HTTPS so they reach your other devices.
• It only shows what you choose. Speed Dial 2 never rewrites your links, never adds bookmarks you didn't choose, and never changes your search engine. It replaces the new tab page and nothing else.
• Permissions with a purpose. Speed Dial 2 can see your most visited sites (to suggest your first bookmarks), your open tabs (so Jump can switch to them and you can save the current page), and its own storage. It also asks for access to websites so it can take a screenshot of a page for its tile; Chrome describes that as reading data on websites. Your browser bookmarks and recently closed tabs are optional permissions it asks for only when you turn on the sidebar.
• Paid for by Pro. Speed Dial 2 is free, and Speed Dial 2 Pro ($12 a year) is how the product is funded. You can export all your data or delete your account at any time.

The details are in our privacy policy.

A new tab page that works only for you

Visual bookmarks in groups, search and widgets, with no tracking code and no sponsored tiles. Free for Chrome, Edge, Firefox and Brave.

Get Speed Dial 2  –  it's free

Looking for something different? Our honest roundup of the best new tab page extensions covers other good options and what each one is best for.