Is Calculator Extension safe?
We analyzed Calculator Extension version 0.0.3's actual code and gave it a 82/100 trust score. A narrowly scoped calculator and new-tab search extension…
Bottom line
A narrowly scoped calculator and new-tab search extension has modest concerns because searches go through an identified third-party service.
What it can access
It requests no permissions and only replaces the new-tab page for its calculator and search features.[Q1][Q9] Searches leave the browser when submitted.[Q6]
Security weaknesses
The main weakness is that searches are routed to a fixed outside service, while the new-tab replacement changes a visible browser setting.[Q24][Q9]
Signs of misuse
There is limited evidence of commercial tracking: submitted searches include fixed publisher and channel values, but no browsing surveillance or sensitive-data collection is shown.[Q6][Q13][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It replaces Chrome's new-tab page with its calculator and search interface. It requests no permissions and cannot inject into ordinary websites.
Declares only a new-tab override and an empty permissions array. — manifest.json:4-22
Defines the replacement new-tab calculator and search page. — src/main.html:15-72
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, host permissions, activeTab, scripting, or background worker. — manifest.json:4-22
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Contains one search input, a disabled calculator display, and calculator buttons on the extension page. — src/main.html:17-67
Grants no access to normal webpages or browser data. — manifest.json:4-22
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The permissions array is empty and no background worker is declared. — manifest.json:4-22
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests no device or file-related permissions. — manifest.json:4-22
Implements only search submission and local calculator arithmetic. — js/script.js:1-125
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Submitting the search form sends the exact query to brownmile.com with fixed publisher and channel identifiers. The new-tab page also contacts cdnjs.cloudflare.com for a stylesheet; no other first-party network path exists.
Reads #search-input and navigates to https://brownmile.com/?pub=103&ch=1636&query= followed by the entered text. — js/script.js:5-11
Loads Font Awesome CSS from cdnjs.cloudflare.com. — src/main.html:9-13
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads one remote CSS file while all JavaScript is packaged locally. — src/main.html:9-13,69-72
Contains no fetch, XMLHttpRequest, WebSocket, or remote configuration handler. — js/script.js:1-125
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The new-tab replacement is always active after installation, and its remote stylesheet loads when a new tab opens. Query transmission occurs only when the user submits the search form.
Registers src/main.html as the browser's new-tab override. — manifest.json:18-22
Routes a query only from the form submit handler. — js/script.js:5-11
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It changes the browser's new-tab page. It does not change the default search provider, homepage, proxy, privacy settings, or other extensions.
Uses chrome_url_overrides.newtab to replace new tabs with its local page. — manifest.json:18-22
Requests no settings, proxy, search, or management permission. — manifest.json:4-22
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Provides readable search and calculator logic. — js/script.js:1-125
Identifies itself as jQuery 3.6.4. — js/jquery-3.6.4.min.js:1-2
Identifies itself as Bootstrap 3.3.7. — js/bootstrap.min.js:1-6
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Calculates through explicit arithmetic branches without dynamic execution. — js/script.js:1-125
Contains no eval or Function-constructor call. — js/jquery-3.6.4.min.js:1-2
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Appends the user-entered search query to a brownmile.com navigation. — js/script.js:5-11
Declares no tabs, history, webNavigation, or content-script access. — manifest.json:4-22
Does it create a persistent ID or browser fingerprint to recognize you?
Searches include fixed pub=103 and ch=1636 values that identify the publisher or affiliate channel. No generated user identifier, cookie, fingerprint, or per-install token was found.
Hard-codes the same pub and ch values for every submitted search. — js/script.js:5-11
Requests neither cookies nor storage. — manifest.json:4-22
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies, identity, storage, or site-access permission. — manifest.json:4-22
Contains a plain search input on the extension's own page. — src/main.html:17-23
Does it record typing, form entries, clipboard contents, or screenshots?
It reads the value of its own search input when the form is submitted. It does not record individual keystrokes, read other forms or the clipboard, or capture screenshots.
Reads #search-input once from the form submit handler. — js/script.js:5-11
Provides no access to other webpages, capture APIs, or clipboard APIs. — manifest.json:4-22
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no remote response handler or command channel. — js/script.js:1-125
Declares no background worker, content script, or externally connectable interface. — manifest.json:4-22
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Updates only the local #result calculator element. — js/script.js:36-125
Declares no site access or content script. — manifest.json:4-22
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no downloads, webRequest, declarativeNetRequest, or proxy permission. — manifest.json:4-22
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission and declares no background worker. — manifest.json:4-22
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads CSS remotely but all scripts from fixed packaged files. — src/main.html:9-13,69-72
Has no code-fetching or dynamic-execution path. — js/script.js:1-125
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable, content_scripts, web_accessible_resources, or background service worker. — manifest.json:4-22
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Contains fixed calculator behavior and one fixed search destination without conditional targeting. — js/script.js:1-125
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Performs only short calculator arithmetic over the current input queue. — js/script.js:36-125
Declares no worker or background process. — manifest.json:4-22
Does it change form fields or where a form sends its information?
It intercepts its own new-tab search form and sends the entered query to brownmile.com instead of the form's # action. This is a user-triggered search flow, not manipulation of a third-party page or theft of an existing form submission.
Defines the extension-owned search form with action #. — src/main.html:17-23
Prevents the default submit, reads the search field, and navigates to brownmile.com with the query. — js/script.js:5-11