Is Save Tab Groups for Tab Session Manager safe?
We analyzed Save Tab Groups for Tab Session Manager version 1.0.2's actual code and gave it a 82/100 trust score. This is a narrowly focused tab-group…
Bottom line
This is a narrowly focused tab-group extension with a meaningful weakness: other extensions can issue unverified commands to change group settings.
What it can access
The extension requests only tab-group access, which fits saving and restoring tab groups. [Q1] It can read group details such as titles, colors, and window association, but there is no evidence it can read page contents or web addresses. [Q4]
Security weaknesses
The extension accepts messages from other extensions without restricting which sender may request changes. [Q8] This could let an installed, potentially compromised extension alter tab-group titles, colors, or collapsed state without a clear request in this extension. [Q8]
Signs of misuse
There is no evidence of data collection, tracking, network transmission, credential access, or deceptive website changes. [Q6] The unverified messaging is a security weakness, but the evidence does not show that it has been used for abuse. [Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only tabGroups, which is appropriate for saving and restoring tab groups. The permission exposes group organization and permits presentation changes, but not tab URLs or page contents.
Declares only tabGroups. — manifest.json:permissions
Uses chrome.tabGroups.query and chrome.tabGroups.update. — background.js:handleMessage
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content_scripts, host_permissions, or scripting permission. — manifest.json:top-level fields
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
tabGroups access does not grant page access or tab URL access. — manifest.json:permissions
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can return tab-group records, which include group IDs, window IDs, user-assigned titles, colors, and collapsed state. It cannot read the URLs or titles of tabs inside those groups.
Passes caller-supplied queryInfo to chrome.tabGroups.query and returns the result. — background.js:query case
Requests tabGroups but not tabs, history, cookies, bookmarks, or downloads. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Only tabGroups is requested. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains only external runtime messaging and tabGroups API calls; no network primitive or URL exists. — background.js:entire file
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All logic is packaged in a 501-byte service worker with two fixed operations. — background.js:entire file
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
An external extension can command it to query groups or update a selected group's title, color, or collapsed state without an action in this extension's UI. The listener does not restrict the sender to Tab Session Manager.
Accepts caller-supplied groupId and updateProperties and invokes chrome.tabGroups.update. — background.js:onMessageExternal and update case
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
The only mutation is chrome.tabGroups.update. — background.js:update case
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The complete implementation is 501 bytes of readable source. — background.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses a fixed switch and direct Chrome API calls only. — background.js:entire file
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no tabs or history permission. — manifest.json:permissions
Queries tabGroups rather than tabs. — background.js:query case
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no storage or analytics code. — background.js:entire file
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies, webRequest, tabs, or host access is declared. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Only tabGroups is requested and no page script exists. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Registers a global external-extension listener and immediately switches on message.request without authorization. — background.js:handleMessage and onMessageExternal
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No website access or content script is declared. — manifest.json:top-level fields
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads, or proxy access exists. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or host access is declared. — manifest.json:permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
No decoder, script injection, or execution sink exists. — background.js:entire file
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable declaration or content script. — manifest.json:top-level fields
Accepts extension-origin external messages. — background.js:onMessageExternal
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior depends only on the two explicit request names query and update. — background.js:entire file
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The worker responds only to incoming messages. — background.js:entire file
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or host access exists. — manifest.json:top-level fields