Is Web Historian - Education Edition safe?
We analyzed Web Historian - Education Edition version 1.2's actual code and gave it a 76/100 trust score. This is a purpose-aligned local history…
Bottom line
This is a purpose-aligned local history visualizer with sensitive access and a limited markup-injection weakness.
What it can access
It reads detailed browsing history, including URLs, titles, timing, searches, and visit relationships, which fits its visualization purpose but is highly sensitive.[Q1][Q3][Q4]
Security weaknesses
Attacker-controlled text saved in browsing history can be inserted into the extension’s page without safe handling, creating a limited markup-injection weakness.[Q21]
Signs of misuse
No evidence shows browsing data is sent elsewhere, used for unrelated tracking, or used to control the browser.[Q6][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests history and storage permissions. History is exceptionally sensitive because it exposes visited URLs, titles, timestamps, visit counts, transitions, and referral relationships; that access directly supports the advertised visualization feature.
Declares history and storage permissions. — manifest.json:1
Calls chrome.history.search and chrome.history.getVisits for the browser's history index. — js/app/history.js:53-130
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts or host_permissions. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Browsing history can reveal medical, financial, political, sexual, workplace, and account activity. The code also extracts search terms from Google, Bing, DuckDuckGo, AOL, Ask, and Yahoo URLs, making sensitive intent directly visible in the extension UI.
Transforms full history URLs/titles and decodes search query parameters into searchTerms. — js/app/fetch-worker.js:154-260
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads the full URL/title history index and visit records, including timestamps, visit IDs, referring visit IDs, transition types, domains, titles, and derived search terms. It does not access cookies, bookmarks, or downloads.
Reads history items and visits. — js/app/history.js:53-130
Builds detailed visit records and referral relationships. — js/app/fetch-worker.js:154-280
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A visible button exports the complete processed history dataset as a local JSON download. It does not use clipboard, camera, microphone, geolocation, native messaging, or direct filesystem services.
Creates a Blob containing JSON.stringify(history.fullData) and downloads web_historian_data.json after a click. — js/app/history.js:286-336
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
categoriesUrl points to a bundled local JSON file. — js/app/config.js:1-8
Loads only the configured category file. — js/app/history.js:34-51
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Category configuration resolves to the packaged categories.json file. — js/app/config.js:1-8
RequireJS loads fixed local modules. — js/app/main.js:1-35
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On first installation it automatically opens its local index page, which immediately begins reading and processing history. Later analysis runs when the user opens the extension page; there is no scheduled background collection.
Opens index.html on install. — background.js:1-5
Document-ready flow loads and visualizes history. — js/app/history.js:338-355
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Confirmed UI handlers select URLs/domains for deletion. — js/app/data-table.js:278-335
Calls chrome.history.deleteUrl and stores aggregate removal records locally. — js/app/utils.js:280-340
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Shows readable app modules and ordinary bundled jQuery, D3, Bootstrap, RequireJS, Moment, and UI assets. — inventory.json:complete file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Defines the fromText/eval fallback. — js/lib/require.js:22-37
Loads fixed packaged modules without RequireJS plug-ins. — js/app/main.js:1-35
Does it track the websites, pages, searches, or links you visit?
Tracking browsing is the product's core feature: it reconstructs visits from about the last 91 days, derives search terms and referral links, and visualizes frequency and timing. The dataset remains in the extension page's memory unless the user exports it.
Filters visits to a 91-day window and builds detailed fullData records. — js/app/fetch-worker.js:125-335
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores only removal timestamps and counts. — js/app/utils.js:294-340
Uses sessionStorage for date bounds and local categories. — js/app/history.js:1-51
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or webpage access is requested. — manifest.json:1
Processes complete stored URLs from browser history. — js/app/fetch-worker.js:154-280
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content script, clipboard, desktopCapture, tabCapture, camera, or microphone capability. — manifest.json:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or content-script entry. — manifest.json:1
Background handles only the install event. — background.js:1-5
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No webpage injection or request-modification capability. — manifest.json:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or network host access. — manifest.json:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
detailFormatter concatenates raw row title, domain, terms, and URL into returned HTML. — js/app/data-table.js:80-135
Weekly summary concatenates derived domains/search terms into HTML. — js/app/history.js:286-324
Can ordinary websites access privileged extension features through messaging or exposed files?
A website cannot message the extension directly, but it can place attacker-controlled title and URL text into browser history. When the user opens the all-visits table, that data reaches unescaped extension-page HTML, creating a limited website-to-extension markup-injection bridge.
Copies history item URL/title into the processing pipeline. — js/app/history.js:53-75
Inserts those values into HTML without escaping. — js/app/data-table.js:80-135
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Navigation selects local visualizations. — js/app/home.js:1-90
Date/table selection and confirmation control deletion. — js/app/data-table.js:260-335
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Searches with maxResults 2147483647 and requests visits for each URL. — js/app/history.js:53-130
Processes records in batches and posts the completed dataset back to the UI. — js/app/fetch-worker.js:125-335
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or host access. — manifest.json:1