Are New Tab Extensions Safe? Permissions Explained

Yes, most of them are, and the test is simple. A new tab page needs exactly one permission: replace the page you see when opening a new tab. Everything past that, your history, your bookmarks, every site you visit, should be paid for by a feature you can point at. This guide shows you how to check.

Last checked 2 September 2026. Every permission string, policy line and store listing quoted below was read on that date.

The one permission a new tab page needs

Every new tab page in the Chrome Web Store works the same way. The manifest declares an override for the new tab, and Chrome hands the page over. In Chromium's own test for permission messages, that manifest entry produces exactly one line for you to accept: "Replace the page you see when opening a new tab".

Two limits ship with it. An extension can override only one Chrome page, so the same product cannot take your bookmarks manager as well. And in incognito windows, extensions cannot override the new tab at all.

What that line does not cover is worth saying out loud. It grants no access to the sites you browse, no access to your history, no access to your bookmarks, and no control over your search engine. An extension that only replaces the new tab can draw whatever it likes on its own page, and nothing anywhere else.

Now the honest half. You are still handing over the page you open more often than any other, and the code that runs there is someone else's. No dialog can settle that for you. The rest of this guide is how to decide with evidence instead of a hunch.

What the other permission warnings mean

Chrome turns manifest entries into plain sentences. Some of those sentences sound worse than they are, and one or two sound milder than they are. Here is the mapping, from Chrome's own permissions reference and Chromium's permission-message tests.

Sources: Chrome's permissions reference for the per-permission warnings, and Chromium's permission message tests for the combined strings.

Two of those deserve a footnote. "Read your browsing history" is the warning for tabs, which is really about the tabs you have open, so a tab manager triggers a scary line for an ordinary reason. And storage, the permission that holds your notes and your layout, shows no warning at all, because it is the extension's own private storage rather than yours.

Chrome Web Store listings use a friendlier vocabulary for the same ideas. Google's permissions help page explains that "Your data on all the websites you visit" lets an extension "read, request or modify data from every page you visit", that "Your browsing history" means it "can read and erase your browsing history", and that "Your tabs and browsing activity" means it "can see the URLs and titles of websites you visit".

The rule that follows is short. Match every permission to a feature you can name on the page. Weather earns location. A bookmarks widget earns bookmarks. A wallpaper and a clock earn neither. Google asks developers for the same discipline in its program policies: "Request access to the narrowest permissions necessary to implement your Product's features or services."

How to read a listing in two minutes

1. Look at the badges, and know what they mean

   Google says items "featured on the Chrome Web Store are manually selected based on specific eligibility criteria", and that the Established Publisher badge "showcases developers who have verified their identity and demonstrated compliance with the developer program policies". Neither is for sale: "developers cannot pay to receive either badge". A badge is a floor, not a guarantee.

2. Open the privacy practices section

   Before a listing goes live, its developer has to give a single-purpose description, justify every permission in the manifest, declare any remote code, disclose what data the product collects, and certify compliance with the limited use policy. That is the dashboard requirement every publisher meets, including us.

3. Read the disclosure line

   A listing either says "The developer has disclosed that it will not collect or use your data" or it lists what it handles under a heading that reads "handles the following", with entries such as personally identifiable information, authentication information, location or web history. That line is the quickest read on whether a product keeps things on the device or sends them home. It is a developer declaration rather than an audit, so weigh it against what the product visibly does.

4. Read the three certifications

   The listings above all carry the same three: data is "Not being sold to third parties, outside of the approved use cases", "Not being used or transferred for purposes that are unrelated to the item's core functionality", and "Not being used or transferred to determine creditworthiness or for lending purposes". They are promises with policy behind them, and they apply to whatever the developer disclosed above.

5. Check the version, the date and the newest reviews

   A page you open forty times a day should be maintained. Sort reviews by most recent rather than most helpful, and look for the pattern words: lost my settings, logged out, stopped loading. A stale date is not fraud, but it tells you who is on the other end.

What seven new tab listings actually disclose

All of these are real products with real users, and none of them is a scam. The differences below are the differences you are agreeing to.

Ours is the first row because we wrote this page, not because it earned the spot; the rest are in order of install count, and our own disclosure is one of the three here that admits to handling personal data. Read on 2 September 2026 from each product's Chrome Web Store listing: Momentum, Infinity New Tab, Bonjourr, Live Start Page, Homey, Tabliss and the original Dashy.

Three things to take from that table. The most-installed product is not the most private one. A page that stores everything locally can say it collects nothing, which is why Bonjourr and Tabliss can make that claim while a product with accounts and sync cannot; ours cannot either, and we say so below. And a four-year-old update date next to a hundred thousand users is a maintenance question, not a safety one, though the two eventually meet.

Live Start Page is the useful case, because it discloses the most and does it on its own listing. Its description says the extension "changes your search bar inside the Live Start Page to Bing", mentions "sponsored bookmark tiles (for example Amazon bookmark)", and states that it "has built-in monetization (ads)". Its privacy section lists web history among the data it handles. That is a legitimate trade, disclosed in advance. Homey does the same in one sentence: "The free version of Homey may display clearly labeled ads marked as 'Sponsored' on the new tab page." Infinity New Tab discloses a milder version of the same thing: "Some merchant shortcuts in Infinity may use affiliate links", and it adds that those links "are only activated following your explicit action and are not automatically injected, modified, or replaced while you browse other websites". What you want to avoid is any of this behavior without the sentence.

Four red flags

A search engine you did not pick. Store policy is explicit: "Any changes to device settings must be made with the user's knowledge and consent and be easily reversible by the user." A product that names the swap on its listing is inside the rules. One that swaps quietly, or makes the setting hard to find, is not.

Ads that appear where the extension does not live. Policy again: ads "must be presented in context or clearly state which product they are bundled with", and they must be "easily removable by either adjusting the settings or uninstalling the product altogether". Ads on your new tab, labeled, are a business model. Ads injected into other people's websites are a different thing.

Permissions with no matching feature. A wallpaper page asking to read and change all your data on all websites is the clearest signal in the category. So is any listing whose permission justifications read like filler.

No privacy policy, or a vague single purpose. Both are required before a listing goes live. When they are thin, the developer has already told you how much care went into the rest.

If your new tab already changed without asking

Work in this order, from Google's own guide to unwanted software.

1. Remove the program, not just the extension

   Check the applications installed on your computer first and uninstall anything you did not choose. Resetting Chrome before that step lets the program put the change back.

2. Reset Chrome's settings

   Open Settings, then Reset settings, then "Restore settings to their original defaults". Google lists what that touches: the default search engine, the homepage and tabs, the new tab page, pinned tabs, and extensions and themes. Your saved bookmarks and passwords are not deleted or changed.

3. Turn back on only what you trust

   Re-enable extensions one at a time from the Extensions menu. Chrome also checks for settings changes each time it starts, so a hijacker that survives will usually show itself again quickly.

If what you want is the opposite, a new tab you chose on purpose, our walkthrough of how to change the new tab page in Chrome covers every route, including the ones that install nothing.

How Dashy handles your data

We build one of these, so treat this as a disclosure rather than a review.

There are two of them, and the permissions story is the same for both. The original Dashy is the one you can install today: on the Chrome Web Store since 2023, 36 widgets, wallpapers, soundscapes, profiles and sign-in sync, at 4.7 stars from 273 reviews. It is a 2023 design and looks it, which is why the new Dashy is a ground-up rebuild arriving in October 2026 on its own listing, with the original left running. The two are set out side by side here.

Dashy works without an account. The wallpapers, the soundscapes, the clock, the greeting, the weather, your notes and your tasks all run on the device, and nothing leaves it until you connect something. When you do connect something, Google Calendar, Todoist or Google Tasks, what that integration reads is disclosed for that integration and nothing else. Sync across devices and connected services belongs to the paid plan. Customization does not: adding, moving, resizing and restyling anything on the page is free, with templates that lay out a whole tab in one tap.

Dashy does not change your search engine, your homepage or your startup page. It replaces one page, the one you asked it to replace, on Chrome, Edge, Brave and other Chromium browsers.

Be fair to the table above: the original Dashy's listing discloses that it handles personally identifiable information, because it has accounts and sync. A product with accounts cannot honestly say it collects nothing, and a listing that claims both is worth a second look. The listing also carries 10,000+ users, 4.7 stars from 273 reviews and a Featured badge. The new Dashy arrives in October 2026.

One newer thing belongs in a piece about trust. Dashy can be connected to an AI assistant over MCP, which means an assistant you already pay for can rearrange your tab. We wrote three rules into it before we wrote the feature: you approve each app by name, every change it makes is written down where you can read it, and anything it invents stays switched off until you have looked at it. That is in early access now. The reasoning is on our AI page.

Everything above is written out in full on our privacy page, and the new Dashy is reachable before October only through the early access form. If you want the category explained before you pick anything, start with what a new tab dashboard is, or read our side-by-side with Bonjourr, whose listing says it will not collect or use your data.

What to check before you click Add

One permission is the price of a new tab page, and Chrome shows it in one sentence. Anything else on the dialog should map to a feature you can see. Read the privacy line on the listing, check the update date, sort the reviews by newest, and look for the sentence where the developer explains how they get paid. If that sentence is missing and your search engine changes anyway, you have your answer. The good products in this category tell you what they do before you install them, and then do only that.