Is iCloud Bookmarks safe?
We analyzed iCloud Bookmarks version 2.3.40's actual code and gave it a 80/100 trust score. This appears to be a purpose-aligned bookmark synchronizer…
Bottom line
This appears to be a purpose-aligned bookmark synchronizer with moderate access and no established abuse.
What it can access
It can read and change all bookmarks and communicate with iCloud for Windows, which fits synchronization but is still powerful access. [Q1] [Q4] [Q5] [Q19]
Security weaknesses
The local application bridge can apply bookmark changes automatically, but only fixed bookmark actions were found and no website access was exposed. [Q7] [Q8] [Q16] [Q21]
Signs of misuse
No misuse was established: data sharing is limited to bookmarks and browser details for synchronization, with no tracking, sensitive-data collection, or remote code execution found. [Q6] [Q11] [Q12] [Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests complete bookmark read/write access and native application messaging. Both are powerful but necessary for the advertised iCloud bookmark synchronization.
Declares bookmarks, nativeMessaging and storage permissions. — manifest.json:20-24
Connects only to com.apple.bookmarks and implements two-way bookmark synchronization. — background.js:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No host_permissions, content_scripts or scripting permission is declared. — manifest.json:1-31
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The package has no website execution or host access capability. — manifest.json:1-31
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads all bookmark folders, titles and URLs and can create, update, move or delete bookmarks. It does not access cookies, browser history or downloads.
buildClientTree calls chrome.bookmarks.getTree and sends each folder and bookmark to the native host. — background.js:1
Native commands invoke bookmark create, update, move, remove and removeTree operations. — background.js:1
No cookies, history or downloads permission is declared. — manifest.json:20-24
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It communicates with the separately installed iCloud for Windows native application. It does not directly access files, location, camera, microphone or clipboard.
chrome.runtime.connectNative connects to the fixed host com.apple.bookmarks. — background.js:1
No file, geolocation, camera, microphone or clipboard permission is declared. — manifest.json:20-24
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the entire bookmark tree plus bookmark-change events to Apple's local native application for synchronization. It also sends extension version and browser user-agent details.
Folder titles and bookmark titles/URLs are posted through the native port during initial tree building and on every bookmark change. — background.js:1
CmdInit contains extVersion, navigator.userAgent and userAgentData brands. — background.js:1
No fetch, XMLHttpRequest, WebSocket or other direct remote transport appears in the complete service worker. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It does not download or execute remote code. It does accept fixed bookmark-operation instructions from Apple's native application, whose upstream cloud behavior is not visible in this package.
The native listener maps numeric commands only to fixed bookmark operations, state updates and opening chrome://extensions. — background.js:1
No remote hosts or website execution are declared. — manifest.json:1-31
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Once iCloud bookmark sync is enabled, bookmark changes are automatically mirrored in both directions without separate confirmation for every create, edit, move or deletion. That is the advertised behavior.
Registers all bookmark change listeners and immediately forwards their details to the native application. — background.js:1
Executes incoming native bookmark-operation commands as they arrive. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Only bookmarks, nativeMessaging and storage permissions are requested. — manifest.json:20-24
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The complete 5.3 KB worker uses descriptive operation names and literal native command mappings. — background.js:1
The complete 2 KB popup implements only status display and explicit buttons. — popup.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No dynamic-code primitive appears in the complete worker. — background.js:1
No dynamic-code primitive appears in the complete popup. — popup.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, webNavigation, host or content-script access is declared. — manifest.json:20-24
URL handling is limited to URLs stored in Chrome bookmarks. — background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
CmdInit sends userAgent and browser brands; no random ID, hardware probing or fingerprint construction exists. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission, host access or content script is present. — manifest.json:1-31
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No webpage, clipboard, desktopCapture or tabCapture access is declared. — manifest.json:1-31
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
port.onMessage maps CmdChangeAddFolder through CmdChangeMove to fixed chrome.bookmarks calls and maps ShowExtensionsPage to chrome://extensions. — background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
All runtime behavior is bookmark synchronization and native application status handling. — background.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is declared. — manifest.json:20-24
Can it communicate with software on the computer or services running on localhost?
It connects to the locally installed com.apple.bookmarks native application. That bridge can exchange the full bookmark tree and bookmark-edit commands but does not grant generic file or shell access in the extension code.
Uses chrome.runtime.connectNative with the literal host name com.apple.bookmarks. — background.js:1
Declares nativeMessaging permission. — manifest.json:20-24
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
No decoder, encrypted payload, archive loader or injection routine exists. — background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or web_accessible_resources declaration is present. — manifest.json:1-31
Uses internal runtime messaging only; no onMessageExternal listener exists. — background.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The service worker immediately connects to the native host and registers the same fixed listeners for all users. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Work is limited to bookmark tree traversal and event forwarding. — background.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No website execution capability is declared. — manifest.json:1-31