Is Smart Mute safe?
We analyzed Smart Mute version 6.3.0's actual code and gave it a 76/100 trust score. Smart Mute appears purpose-aligned, but its tab tracking and…
Bottom line
Smart Mute appears purpose-aligned, but its tab tracking and persistent analytics telemetry reduce trust.
What it can access
The manifest requests storage access and optional tab metadata access, which fit a tab-muting tool [Q4]. It can retain selected URLs and tab details, but no page-content or sensitive-form access is established [Q12].
Signs of misuse
The extension sends usage and configuration telemetry to Google Analytics using a persistent installation identifier [Q6]. There is no established evidence that it sends cookies, passwords, page contents, or authentication data [Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests storage access and optional tab metadata access, which generally fits its purpose of muting tabs one at a time, but it also retains selected tab details and sends usage telemetry.
The manifest declares storage permission and optional tabs permission. — manifest.json:1
The extension monitors audible-tab state and stores current and previous tab records to manage muting. — assets/js/app.js:1
When the user creates a muting rule, the extension reads and stores the active tab URL, title, and favicon. — assets/js/list.js:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence was found in the manifest or package for this capability.
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
There is no evidence that it reads passwords, payment details, messages, or form fields. It uses tab metadata and settings rather than page contents.
No content-script or scripting permissions are declared. — manifest.json:15-23
The traced tab logic uses audible status, URL metadata, activity, and mute state. — assets/js/app.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It does not access cookies, history, bookmarks, or downloads in the traced code. With the optional tabs permission, it can read tab metadata such as URLs, titles, and favicons, and stores selected tab records and list entries in extension storage.
Declares storage and optional tabs, but not cookies, history, bookmarks, or downloads. — manifest.json:15-23
Reads the active tab and stores its URL, title, and favicon information for list entries. — assets/js/list.js:1
Stores current and previous tab records in session storage. — assets/js/app.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends telemetry to Google Analytics, including a persistent client ID, session ID, extension version, event names, feature settings, list counts and types, and interaction data. The reviewed calls do not intentionally include saved URL strings, cookies, page contents, or authentication data.
Defines the Google Analytics Measurement Protocol endpoint and sends POST requests containing client_id, session_id, version, page metadata, event names, and event parameters; stores the client ID locally and session data in session storage — assets/js/google-analytics.js:1
Calls analytics for lifecycle, settings, permission, last-audible, popup/list connection, and beta events — assets/js/app.js:1
Calls analytics for feature toggles, popup interactions, support/report actions, and modal views — assets/js/popup.js:1
Calls analytics for list views, saves, deletions, list counts, list type, and URL-entry type — assets/js/list.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The traced code does not download or execute remote code, settings, or instructions. It makes telemetry requests and opens fixed web destinations, which is different from remotely supplied code execution.
Uses fetch for fixed Google Analytics telemetry. — assets/js/google-analytics.js:1
Creates tabs at fixed Smart Mute, Google Forms, and uninstall-related destinations; no response is evaluated as code. — assets/js/app.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It can automatically mute or unmute audible tabs in response to tab events and settings. It also opens an installation page on install and may open an inactive survey tab after repeated remembered-tab events.
Tab activation, focus, update, and removal handlers trigger mute decisions and tab updates. — assets/js/app.js:1
On installation it creates an active Smart Mute installation tab. — assets/js/app.js:1
After the beta threshold it creates an inactive fixed Google Forms survey tab. — assets/js/app.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The available JavaScript is generated or bundled and refers to missing source maps, so original source-level code cannot be fully compared. However, the mapped runtime behavior is substantially covered and no third-party runtime code supply was identified.
Background behavior is contained in a bundled service-worker file. — assets/js/app.js:1
Analytics is bundled and reachable from multiple extension components. — assets/js/google-analytics.js:1
The file references source maps that are not present in the package inventory. — assets/js/app.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No reachable use of eval(), new Function(), or string-based timers was identified in the traced runtime code. Missing source maps leave a small source-level gap.
The mapped service-worker behavior uses ordinary event handlers and API calls, with no identified dynamic code evaluation. — assets/js/app.js:1
The mapped popup behavior uses DOM handlers, storage, ports, and fixed navigation. — assets/js/popup.js:1
Does it track the websites, pages, searches, or links you visit?
The extension retains browsing-related tab information and can save the active tab’s URL, title, and favicon when the user adds a whitelist or blacklist entry. It also keeps current and previous audible-tab metadata in session storage, but the reviewed analytics payloads report list metadata rather than the actual URLs visited.
Reads the active tab and stores its URL, title, favicon, and whether the entry is an exact URL or domain when the user adds a list item — assets/js/list.js:1
Tracks current and previous audible tabs and writes tab metadata to chrome.storage.session in response to tab activation, focus, update, and removal events — assets/js/app.js:1
Sends usage events and identifiers to Google Analytics, with reviewed event arguments containing list counts/types and feature activity rather than saved URL strings — assets/js/google-analytics.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
The extension creates a random persistent client identifier for analytics and stores it in extension local storage. It also creates a session identifier in session storage, but the reviewed code does not implement a browser fingerprint.
getOrCreateClientId reads clientId from chrome.storage.local and otherwise creates one with crypto.randomUUID; getOrCreateSessionId stores a timestamp-based session_id in chrome.storage.session and refreshes it for activity within the 30-? — assets/js/google-analytics.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The reviewed runtime code sends analytics metadata but does not send cookies, session tokens, authentication data, or page contents elsewhere. It stores selected tab URLs in extension storage and sends list counts and types, not the saved URL values themselves.
The only reviewed external telemetry request is a POST to Google Analytics containing generated identifiers and event parameters; it does not read browser cookies or page contents — assets/js/google-analytics.js:1
Background analytics calls use lifecycle, settings, permission, tab-state, and beta counters; tab metadata is used for muting and session storage — assets/js/app.js:1
Popup analytics calls report feature and interaction metadata — assets/js/popup.js:1
List analytics calls report list counts, list type, URL-entry type, saves, and deletions; saved URL strings are stored locally/synchronously but are not passed to the analytics calls — assets/js/list.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No code was identified that records typing, form entries, clipboard data, or screenshots. The extension handles tab audio state and popup settings instead.
Declares only storage and optional tabs permissions; no content scripts or capture-related permissions are declared. — manifest.json:1-1
Observed event handling concerns tabs, storage, permissions, and muting, not keyboard, clipboard, form, or screenshot capture. — assets/js/app.js:1
Can a website or remote server send commands that make the extension take actions?
No externally supplied command channel was identified. Runtime messaging is used for the popup's permission request flow, and no content scripts or external messaging endpoints were found.
Handles named runtime ports for popup permission requests; no externally supplied action commands were identified. — assets/js/app.js:1
Sends permission-request messages from the extension popup. — assets/js/popup.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The extension does not alter links, referral codes, ads, carts, or search results. It stores user-selected URL/domain rules only to decide which tabs should be muted.
Matches configured URL/domain entries for blacklist and whitelist decisions. — assets/js/helpers.js:1
Uses list matches to control tab muting, not page links, advertisements, shopping, or search content. — assets/js/app.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence shows traffic interception, header changes, download manipulation, or proxy changes. The extension changes tab mute state and opens a few fixed web pages.
Declares no webRequest, downloads, proxy, or host permissions. — manifest.json:1-1
Uses tab queries and tab updates for audio muting; no traffic or header modification is identified. — assets/js/app.js:1
Can it communicate with software on the computer or services running on localhost?
No communication with native computer software or localhost services was identified. External network activity is analytics and fixed support/survey navigation.
Declares no nativeMessaging permission. — manifest.json:1-1
Network destination is Google Analytics, not localhost or a local application. — assets/js/google-analytics.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No hidden-data decoding, decryption, unpacking, or subsequent execution/injection was identified. The reviewed scripts perform ordinary extension logic and analytics calls.
Observed logic covers storage initialization, tab events, permissions, surveys, analytics, and muting. — assets/js/app.js:1
Migrates and matches list entries; no dynamic code execution or payload unpacking was identified. — assets/js/helpers.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites were not given access to privileged extension features. No externally connectable declaration, content script, or web-accessible resource was identified.
Contains no externally_connectable, content_scripts, or web_accessible_resources declarations. — manifest.json:1-1
Runtime port handling is for the extension popup permission flow, not ordinary web pages. — assets/js/app.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Some behavior is conditional on settings, tab state, feature lists, event counts, and lifecycle events. A beta survey opens only after more than 25 remembered-tab events; no evidence shows targeting by arbitrary users or remote settings.
Mute decisions depend on enablement, silent mode, pinned status, whitelist/blacklist settings, and active/current tabs. — assets/js/app.js:1
The survey tab is created only after the remembered-tab threshold and when it has not already been shown. — assets/js/app.js:1
User-controlled settings activate or deactivate whitelist, blacklist, and last-audible features. — assets/js/popup.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No hidden resource-intensive work or cryptocurrency mining was identified. Activity is limited to tab-state management, storage, UI, and small telemetry requests.
Background work centers on querying audible tabs, updating mute state, and handling tab events. — assets/js/app.js:1
Network work consists of event POSTs to Google Analytics. — assets/js/google-analytics.js:1
Does it change form fields or where a form sends its information?
The extension does not modify form fields or form destinations. Its URL-list editor reads the active tab URL to create muting rules, not to rewrite forms.
Reads the active tab URL/title/favicon and stores URL or domain list entries. — assets/js/list.js:1
Declares no content scripts or host permissions for modifying ordinary webpage forms. — manifest.json:1-1