Is Tab Manager by Workona safe?
We analyzed Tab Manager by Workona version 3.1.33's actual code and gave it a 66/100 trust score. This is a purpose-aligned tab manager, but it shares…
Bottom line
This is a purpose-aligned tab manager, but it shares detailed browsing state and accepts powerful commands from Workona pages.
What it can access
It can read history and exact open-tab details, then share them with Workona for tab management [Q4][Q12]. It also controls tabs and windows [Q1][Q16].
Security weaknesses
Workona pages can issue privileged browser commands without a fresh confirmation for each action [Q8][Q16]. Protection depends on every allowed Workona origin remaining trustworthy [Q21].
Signs of misuse
The browsing data sharing and persistent IDs support the stated service [Q12][Q13]. No unrelated recipient or sensitive page-data collection was established [Q6][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests history, tabs, storage, unlimited storage and context menus, with optional system-memory and tab-group access. Those capabilities are broadly consistent with a persistent tab/workspace manager, but they expose sensitive browsing state and extensive browser control.
Declares history, tabs, storage, unlimitedStorage and optional system.memory/tabGroups plus Workona host access. — manifest.json:62-73
Maintains tab/window/group state, implements discarding and exposes tab/history operations to the Workona client. — background.js:5
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares only a service worker and popup; there are no content_scripts, scripting permission or web-accessible page scripts. — manifest.json:20-79
Tab operations use chrome.tabs/windows APIs rather than page DOM access. — background.js:5
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content script or scripting capability is declared. — manifest.json:20-79
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can search browser history and continuously query current tabs. The history permission is also used locally to remove Workona's own internal redirect/cache URLs.
Declares history and tabs but not cookies, bookmarks or downloads. — manifest.json:62-68
wS permits history.search from the Workona bridge; Et searches/deletes only fixed Workona internal URLs from history. — background.js:5
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can request the optional system.memory permission and return memory information when the Workona client asks. It does not access files, location, camera, microphone, clipboard, native apps or device inventory.
Lists system.memory as optional rather than always granted. — manifest.json:69
Method 38 requests system.memory and then calls system.memory.getInfo; Chrome mediates the permission request. — background.js:5
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends exact current-tab records, tab groups, window bindings, settings, version, persistent client ID and session ID through an external extension port to a connected Workona webpage. This is the active Workona service and is necessary for its web-based tab manager; no unrelated recipient appears in the package.
Allows external extension connections only from HTTPS workona.com and its subdomains. — manifest.json:74-79
The Rh subscriber posts method 245 with tabs, tabGroups, clientId, sessionId, settings and windowBindings to each connected port. — background.js:5
Does it download or run code, settings, or instructions supplied by a remote server?
Workona webpages supply structured commands that select packaged browser operations. They do not supply JavaScript and no remote text reaches an execution primitive, but the instructions can still cause privileged tab, window, history and settings actions.
onConnectExternal/onMessageExternal route Workona messages through Xh and wS's fixed method/path switch tables. — background.js:5
Chrome restricts the remote instruction source to Workona origins. — manifest.json:74-79
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
A connected Workona webpage can create, move, update, discard and remove tabs or windows without a fresh confirmation for each action. The operations are core to a tab manager and are limited to the vendor-origin bridge, but the package does not independently verify user intent per command.
wS exposes windows.create/update/remove and tabs.create/discard/highlight/move/reload/hide/show/remove/update/group to bridge messages. — background.js:5
Browser origin checks constrain callers to Workona pages. — manifest.json:74-79
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no settings, search-provider, override or proxy permission/configuration. — manifest.json:20-79
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Bundled worker includes named library license notices and readable Chrome API/Workona command strings. — background.js:1-11
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Packaged library initialization uses Function('return this')() solely to obtain the global object. — background.js:1
Remote bridge messages are dispatched through fixed switches and are not passed to Function. — background.js:5
Does it track the websites, pages, searches, or links you visit?
It continuously observes exact URLs and titles for open tabs and shares tab-state updates with connected Workona pages; Workona can also request history searches. This is disclosed by the cloud tab-manager function and goes to the service being used, but it exposes sensitive browsing state rather than merely holding broad latent permission.
Tab listeners maintain tmTabSet, le/Rh broadcast current serialized tab records, and method 245 returns the full current set. — background.js:5
wS's history.search case lets the allowlisted Workona client supply search arguments and receive results. — background.js:5
Does it create a persistent ID or browser fingerprint to recognize you?
It generates a persistent random client ID in local storage and a random session ID in session storage, then sends both to connected Workona pages. These identifiers support product synchronization/session coordination and are not sent to an unrelated party.
OE creates UUID-like random values; bt stores clientId locally and gt stores sessionId in session storage. — background.js:5
Method 245 and port update messages include clientId and sessionId. — background.js:5
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request cookies, webRequest, scripting or ordinary-site host permissions. — manifest.json:62-79
Tab serialization includes browser tab URL/title metadata, not cookies or page content. — background.js:5
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content script, clipboard or tab-capture permission is declared. — manifest.json:20-79
Can a website or remote server send commands that make the extension take actions?
The active Workona web application can command a broad packaged set of privileged operations, including history search, tab/window management, settings changes, optional permission requests and extension self-removal. Chrome's Workona-only origin allowlist is a real safeguard, but compromise of an allowed Workona origin would inherit this control.
Restricts external callers to workona.com and *.workona.com over HTTPS. — manifest.json:74-79
onMessageExternal/onConnectExternal share Fi/Xh with internal callers; Xh and wS enumerate the allowed high-privilege actions. — background.js:5
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Context menu and onboarding handlers construct only fixed workona.com destinations. — background.js:5
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is declared. — manifest.json:62-79
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission or localhost-specific access is declared. — manifest.json:62-79
Contains no native connection or local-service destination. — background.js:1-11
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Packaged code contains serialization, URL parsing and hashing utilities with no data-to-code sink. — background.js:1-11
Can ordinary websites access privileged extension features through messaging or exposed files?
A privileged external messaging bridge is confirmed, but it is not available to ordinary arbitrary websites: Chrome allows only Workona's HTTPS root domain and subdomains. The handler performs no additional per-message origin or user-consent check, so security depends on every allowed Workona origin and account context remaining trustworthy.
Declares the exact externally_connectable origin patterns. — manifest.json:74-79
Registers both onConnectExternal and onMessageExternal and sends them into the same privileged dispatcher as internal messages. — background.js:5
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Workona host access and external connectivity are declared statically. — manifest.json:70-79
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Et enforces configured tabTTL/maxTabs policies and avoids audible/blacklisted tabs; no compute-intensive worker exists. — background.js:5
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or scripting permission can reach webpage forms. — manifest.json:20-79