Is OneTab safe?
We analyzed OneTab version 2.21's actual code and gave it a 82/100 trust score. OneTab is broadly consistent with its tab-management purpose, with…
Bottom line
OneTab is broadly consistent with its tab-management purpose, with moderate access and limited concerns from optional syncing and vendor-controlled actions.
What it can access
It requests tab details and storage needed to save and organize tabs, plus optional bookmarks, reading lists, and OneTab access [Q1][Q4][Q16].
Security weaknesses
The OneTab website can open tabs or manage shared groups after optional approval, but origin checks restrict this to the vendor site [Q16][Q21].
Signs of misuse
Optional syncing and deliberate sharing send tab-library details to OneTab, with encryption for syncing and no evidence of unrelated collection [Q6][Q12][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests access to open-tab details, temporary page interaction, storage, and optional OneTab, bookmark, reading-list, and tab-group features. This is broadly consistent with saving, organizing, restoring, and optionally synchronizing tabs, but it can expose the URLs and titles of open tabs.
Required permissions include favicon, unlimitedStorage, storage, tabs, activeTab, scripting, and contextMenus; optional permissions include readingList, tabGroups, and bookmarks; optional OneTab site access is declared. — manifest.json:1
Tab helpers read URLs, titles, pinned state, and group state from open tabs. — ext-onetab-concatenated-sources-background.js:8-9
Optional import features enumerate the reading list or bookmark tree when those permissions are granted. — ext-onetab-concatenated-sources-import.js:77
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://www.one-tab.com/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Sole content-script DOM access: queries anchor elements for link title; does not touch inputs or forms. — ext-onetab-concatenated-sources-contentscript.js:2
No permissions for form data, autofill, or input monitoring are declared. — manifest.json:54-75
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
OneTab reads all open tab URLs and titles (tabs permission) and, when the user grants optional permissions, can read the full bookmark tree and reading list. It does not request cookies, history, downloads, or session permissions.
Required permissions include 'tabs'; optional permissions include 'bookmarks' and 'readingList'. — manifest.json:54-75
Import UI calls chrome.readingList.query or chrome.bookmarks.getTree to enumerate user data. — ext-onetab-concatenated-sources-import.js:77
Tab-query helpers read URL, title, pinned, and group state from all tabs across windows. — ext-onetab-concatenated-sources-background.js:8-9
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Optional Backup & Sync sends AES-GCM-encrypted tab-library changes plus device/license metadata to OneTab. Share as a web page separately uploads the selected tab URLs, titles, and optional notes so other people can view them.
Encrypts state changes with AES-GCM, authenticates requests with installation/license identifiers and an ECDSA signature, then uploads encrypted frames to /api/sync/changes. — ext-onetab-concatenated-sources-background.js:1-24
The explicit sharing path posts selected shared-page content to https://www.one-tab.com/api/updatePage. — ext-onetab-concatenated-sources-background.js:1-24
Explains end-to-end encrypted optional sync and the separate Share as a web page feature to the user. — _locales/en/messages.json:461-465,918,1961-1965
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
CSP: script-src 'self'; object-src 'self' — no remote script execution allowed on extension pages. — manifest.json:76-78
Remote sync frames are decrypted, parsed as JSON state changes, and applied to IndexedDB; they are not evaluated as code. — ext-onetab-concatenated-sources-background.js:23-24
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On service-worker startup and on online/visibility events, OneTab automatically initializes its database, repairs or migrates stored state, and (if sync is enabled) applies remote change frames to the local library without a new user action. All tab-collection and restoration actions, however, require an explicit user trigger (popup, command, context menu, or OneTab-page button).
Startup code runs database validation, repair, and migration automatically on worker start. — ext-onetab-concatenated-sources-background.js:22-24
Sync applies remote mutations on online/visibility events and startup when credentials exist. — ext-onetab-concatenated-sources-background.js:23-24
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important runtime behavior is difficult to inspect because the extension ships large bundled and minified JavaScript files, with many logical modules compressed into very few physical lines. This is an auditability limitation, not evidence that the code is malicious or dynamically generated.
The 211,981-byte service-worker bundle contains dense minified code and many unrelated logical components on the same physical lines. — ext-onetab-concatenated-sources-background.js:1-24
The 422,186-byte OneTab-page runtime is bundled into a small number of physical lines, making function-level tracing difficult. — ext-onetab-concatenated-sources-onetab.js:1-212
The 302,595-byte popup application is also bundled and minified. — ext-onetab-concatenated-sources-popup.js:1-210
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
CSP script-src 'self' prevents inline or remote script evaluation on extension pages. — manifest.json:76-78
Does it track the websites, pages, searches, or links you visit?
OneTab records the URL and title of every tab the user collects into its library, and when Backup & Sync is enabled those URLs/titles are encrypted and transmitted to one-tab.com.
Tab-query helpers capture URL, title, and state for every collected tab. — ext-onetab-concatenated-sources-background.js:8-9
Sync uploads encrypted tab records (including URLs and titles) to one-tab.com when enabled. — ext-onetab-concatenated-sources-background.js:23-24
'tabs' permission provides access to all open tab URLs and titles; no 'history' permission is requested. — manifest.json:54-75
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a random persistent installation ID in its local database. When Backup & Sync is enabled, that ID and the license ID are sent with signed requests so the service can recognize this browser as a sync device; I found no browser fingerprinting or cross-site advertising use.
Generates a random installId and stores it in IndexedDB when the extension database is created. — ext-onetab-concatenated-sources-background.js:database initialization
Adds X-OneTab-Install and X-OneTab-License to authenticated sync requests and includes the same identifiers in the WebSocket handshake. — ext-onetab-concatenated-sources-background.js:sync request signing
Sync is inactive unless license credentials and a data key are present. — ext-onetab-concatenated-sources-background.js:sync status helpers
Does it send cookies, session details, authentication data, or page contents elsewhere?
When the user enables Backup & Sync, stored tab URLs, titles, notes, folders, and settings are encrypted locally and uploaded to OneTab. When the user deliberately shares a group as a webpage, the selected tab information is uploaded for publication.
Serializes library changes, compresses and AES-GCM encrypts them, then uploads the ciphertext to OneTab. — ext-onetab-concatenated-sources-background.js:sync serialization and upload
Posts explicitly selected shared-page state to /api/updatePage. — ext-onetab-concatenated-sources-background.js:share update handler
The only ordinary page reader retrieves a clicked link's visible title; it does not inspect cookies, forms, or page bodies. — ext-onetab-concatenated-sources-contentscript.js:1-2
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Extracts a link title from nearby page anchors in response to a getLinkTitle message; no input, clipboard, or screenshot APIs are called. — ext-onetab-concatenated-sources-contentscript.js:2
Can a website or remote server send commands that make the extension take actions?
After the user grants optional one-tab.com access, a page on that exact vendor origin can ask the extension to open a supplied list of HTTP(S) tabs, check shared-page ownership, or unshare a group. The bridge checks both the page origin and the Chrome sender URL, so other websites cannot use it.
Declares one-tab.com as an optional host permission rather than granting it by default. — manifest.json:57-72
Forwards page-to-extension messages only when event.source is the same window and event.origin equals the page origin. — ext-onetab-concatenated-sources-one-tab.com-contentscript.js:1-2
Dynamically registers the bridge only after permission and checks sender.url against https://www.one-tab.com before handling openTabs, isPageOwner, or unshare. — ext-onetab-concatenated-sources-background.js:one-tab.com bridge registration and tc handler
Filters supplied URLs to HTTP(S), then opens them through OneTab's tab-restoration routine. — ext-onetab-concatenated-sources-background.js:tc openTabs handler
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Permissions list includes tabs, scripting, storage, contextMenus, favicon, activeTab, unlimitedStorage; no webRequest, proxy, or downloads permission is present. — manifest.json:54-75
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
All API calls target https://www.one-tab.com/api/sync/* and /api/updatePage; no localhost or 127.0.0.1 addresses appear. — ext-onetab-concatenated-sources-background.js:23-24
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
AES-GCM decrypt, decompress, and JSON-parse helpers are used exclusively for sync frame processing. — ext-onetab-concatenated-sources-background.js:16
Dynamic script injection (chrome.scripting.executeScript) is limited to the link-title content script on the user's active tab. — ext-onetab-concatenated-sources-background.js:24
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Only one-tab.com is eligible for optional host access; there is no externally_connectable entry. — manifest.json:70-72
Rejects messages not from the same page window and same origin. — ext-onetab-concatenated-sources-one-tab.com-contentscript.js:1-2
Rejects forwarded messages unless the Chrome sender URL is exactly the OneTab web origin or beneath it. — ext-onetab-concatenated-sources-background.js:tc bridge handler
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Only DOM operation is reading anchor text for link-title extraction; no form manipulation is present. — ext-onetab-concatenated-sources-contentscript.js:2