Is SQLite Manager safe?
We analyzed SQLite Manager version 0.4.8's actual code and gave it a 78/100 trust score. A generally purpose-aligned SQLite tool with broad optional…
Bottom line
A generally purpose-aligned SQLite tool with broad optional website access and a limited old-interface code-execution concern.
What it can access
The extension can optionally request access across all websites, mainly to fetch a database URL that the user chooses. [Q2] It has no demonstrated access to cookies, browsing history, passwords, or ordinary webpage contents. [Q4] [Q14]
Security weaknesses
The older interface deliberately runs user-supplied JavaScript in a sandbox, and its message path lacks demonstrated origin checks. [Q11] This is a contained design weakness, not evidence that a remote website can control the extension. [Q16] [Q21]
Signs of misuse
The extension sends limited installation, update, and uninstall details to the publisher and may open a publisher page after installation or updates. [Q6] [Q8] There is no established collection of browser-session data, hidden mining, search manipulation, or remote command channel. [Q14] [Q16] [Q23]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests local storage, menu, and notification access, plus optional access to any website for user-selected database URLs. This broadly fits a SQLite manager, but the optional all-sites scope is wider than its normal page-independent workflow.
The extension requests storage, contextMenus, and notifications, and optionally allows access to *://*/*. — manifest.json:1
Remote database access requires a URL supplied by the user and a permission request. — data/manager-new/sql.js:18-39
No automatic page scripts are declared. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can communicate with the listed websites, but the manifest does not declare automatic page scripts.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension does not attach to ordinary webpages or monitor their forms, so there is no evidence that it sees passwords, payment details, messages, or other webpage entries. It does process files and SQL text that the user deliberately opens or enters in its own interface.
No content script is declared. — manifest.json:1-1
File access occurs through an explicit file picker or drag-and-drop. — data/manager-new/file.js:110-123
SQL execution is triggered by the extension interface's Execute control. — data/manager-new/components/box-view/core.js:172-177
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It has no cookies, history, bookmarks, downloads, or signed-in-session permissions. Its storage use is limited to extension preferences and SQL-command history.
Permissions are storage, contextMenus, and notifications; no cookies, history, bookmarks, downloads, or sessions permissions appear. — manifest.json:1-1
Stored data is the extension's SQL command history. — data/manager-new/history.js:16-27
The worker reads only extension-local interface preferences. — worker.js:4-5
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends installation, update, and uninstall metadata to its publisher’s homepage, including the extension version, previous version, event type, and name. It also requests and downloads a database from a URL the user supplies, but the inspected code does not send the database contents to the publisher.
On qualifying installation or update events, the service worker opens the publisher homepage with version, previous-version, and event-type parameters; it also sets an uninstall URL containing the extension name and version. — worker.js:48-68
When the user opens a remote database, the extension requests permission for the supplied URL and fetches that URL. The response is loaded locally into SQLite. — data/manager-new/sql.js:18-39
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads text from a remote source and executes it as code. This lets that source change the extension's behavior without a store update.
For an execute message, the sandbox passes the supplied code to eval() and posts the result back. — data/manager-old/sandbox.js:3-15
The computation path passes user-provided expressions to math.eval(). — data/manager-old/api/compute.js:240-243
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It opens the manager when the toolbar action is clicked and may open a feedback/homepage tab automatically after installation or qualifying updates. It also creates a local download when the user chooses Save/Export and sends requests when the user supplies a remote database URL.
The action click opens the selected local manager interface. — worker.js:3-9
Installation/update handling can create a homepage tab and sets an uninstall feedback URL. — worker.js:50-68
Save creates a browser download after the user clicks Save. — data/manager-new/file.js:145-157
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important portions are bundled third-party or generated libraries, including minified math/SQLite code and WebAssembly, and the old interface includes a JavaScript sandbox. The primary extension logic is readable, but complete behavior of all bundled code is difficult to inspect.
Large minified third-party math library is bundled. — data/manager-old/vendor/math.min.js:1-1
Generated/minified SQLite runtime is bundled. — data/manager-new/engine/sqljs-wasm/sql-wasm.js:1-1
Sandbox behavior depends on code passed through postMessage and eval. — data/manager-old/sandbox.js:3-15
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The old interface uses eval() to execute JavaScript supplied through its sandbox messaging interface, and its computation feature evaluates user-entered mathematical expressions. This is deliberate functionality exposed by the extension rather than an implicit remote-code download mechanism.
For an execute message, the sandbox passes the supplied code to eval() and posts the result back. — data/manager-old/sandbox.js:3-15
The computation path passes user-provided expressions to math.eval(). — data/manager-old/api/compute.js:240-243
Does it track the websites, pages, searches, or links you visit?
It records SQL commands entered into the extension's own interface, not the websites, searches, or links visited in the browser. No content script, tab URL monitoring, history API use, or browsing-event tracking was found in the inspected source.
History stores executed SQL statements in extension storage. — data/manager-new/history.js:69-90
No history permission or content script is declared. — manifest.json:1-1
The only inspected tab query finds the active tab solely to place an update page next to it. — worker.js:58-62
Does it create a persistent ID or browser fingerprint to recognize you?
No persistent tracking ID or browser-fingerprint collection was found. Random values are used only for local request bookkeeping.
Math.random() creates temporary IDs for matching database-worker requests. — data/manager-new/sql.js:8-14
Math.random() creates temporary IDs for sandbox message matching. — data/manager-old/api/sandbox.js:37-45
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension does not send cookies, login data, or page contents to a service. It can fetch a database from a URL that the user enters, using normal same-origin credentials behavior.
A user-supplied database URL is fetched after requesting permission; the response is loaded into local SQLite processing. — data/manager-new/sql.js:18-39
The old interface similarly fetches a user-supplied database path after permission. — data/manager-old/api/compute.js:152-163
Does it record typing, form entries, clipboard contents, or screenshots?
It does not record typing, arbitrary form entries, or screenshots. Clipboard access is user-triggered for copying database results and editor paste support.
The Copy button writes displayed database results to the clipboard. — data/manager-new/components/box-view/core.js:152-170
Bundled editor clipboard handling supports paste and copy within the SQL editor. — data/manager-new/components/box-view/editor-view/ace-builds-1.5.0/src/ace.js:3108-3116
Can a website or remote server send commands that make the extension take actions?
No remote command channel was found. The service worker handles only local action clicks, settings, menus, and update-page navigation.
Background listeners respond to the extension action, startup/install, and context-menu selection. — worker.js:3-42
Install/update handling opens the publisher homepage and records a local update timestamp; it does not accept server commands. — worker.js:50-68
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No code alters links, referral codes, advertisements, shopping carts, or search results. It only opens its own interface, help pages, and an update/feedback page.
The action opens the local manager interface. — worker.js:7-9
Help and FAQ commands open fixed pages in new tabs. — data/manager-old/api/tools.js:68-86
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No traffic interception, header modification, download interception, or proxy-setting code was found. User-initiated database downloads are created locally.
Database export creates a local object URL and downloads it through an anchor. — data/manager-new/file.js:145-156
Network access is limited to fetching a database URL supplied by the user. — data/manager-new/sql.js:18-39
Can it communicate with software on the computer or services running on localhost?
No native-messaging or localhost communication was found. The extension uses browser Web Workers and a sandboxed iframe, which are internal browser components.
SQLite processing runs in a Web Worker. — data/manager-new/sql.js:3-14
The old interface creates an internal hidden iframe sandbox. — data/manager-old/api/sandbox.js:5-15
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension intentionally evaluates JavaScript entered in its old interface, but the inspected code does not decode, decrypt, or unpack hidden data before executing it. The sandbox receives code directly through extension messaging and runs it with eval().
The sandbox evaluates the message’s code field directly and returns the result; no decoding, decryption, or unpacking step is shown. — data/manager-old/sandbox.js:3-15
The interface exposes a JavaScript editor described as running commands in a sandboxed window. — data/manager-old/api/tools.js:73-77
The old manager and sandbox are extension-bundled resources; the inspected runtime entry points do not establish a hidden-payload execution pipeline. — data/manager-old/index.html:1-120
Can ordinary websites access privileged extension features through messaging or exposed files?
No ordinary website messaging interface or web-accessible privileged file was found. The message handlers shown are for the extension's own internal sandbox and editor workers.
The sandbox listener communicates with an iframe created by the extension and sends code to that iframe. — data/manager-old/api/sandbox.js:20-45
The background worker registers no externally connectable or runtime message listener. — worker.js:1-42
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No user-, website-, date-, or remote-setting-based payload activation was found. The only date check controls whether the publisher's update/FAQ page is opened after at least 45 days.
The 45-day condition controls update-page display and stores a local timestamp. — worker.js:46-66
The webdriver check only suppresses the FAQ/update behavior under automation. — worker.js:47-49
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency mining or other concealed resource-intensive background work was found. Computation is tied to user database queries, charts, and SQLite processing.
Worker tasks are database execution and export requests. — data/manager-new/sql.js:57-67
Visible handlers process user-requested SQL and math commands. — data/manager-old/index.js:57-112
Does it change form fields or where a form sends its information?
It does not modify website forms or redirect form submissions. It edits its own SQL editor and generates import statements for user-selected CSV files.
CSV data is converted into an SQL INSERT statement and placed into the extension's own input box. — data/manager-old/index.js:18-38
CSV import reads selected local files and executes the user's chosen SQL statement against the active database. — data/manager-new/file.js:52-76