Is Focus by MDS safe?
We analyzed Focus by MDS version 1.0.6's actual code and gave it a 86/100 trust score. Focus by MDS appears purpose-aligned, with moderate browser access…
Bottom line
Focus by MDS appears purpose-aligned, with moderate browser access and no evidence of abuse or serious security weaknesses.
What it can access
It can replace the new-tab page, inspect tabs for its timer, and store task text locally, which broadly fits its productivity purpose. [Q1][Q2][Q3][Q9]
Security weaknesses
Replacing new tabs and automatically focusing the timer page are noticeable but user-related actions, with no broader website or device control shown. [Q8][Q9][Q21]
Signs of misuse
No evidence shows tracking, sensitive-data sharing, remote commands, hidden work, or website manipulation; outside links are user-selected. [Q6][Q12][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only tabs access and control of Chrome's new-tab page. That access supports its timer-completion and new-tab dashboard features, though replacing every new tab is a prominent browser change.
Overrides newtab with index.html and requests only tabs. — manifest.json:chrome_url_overrides and permissions
Uses tab and window APIs to find, focus, or create the timer page. — service-worker.js:openOrFocusExtensionTab
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content_scripts, host_permissions, or scripting permission. — manifest.json:top-level fields
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Users can type task and subtask text into the extension's own new-tab interface, and those entries are retained locally. It cannot observe passwords, payments, messages, or forms on other sites.
Accepts user-authored task text and saves it through the local todos state. — static/js/main.4c395651.js:task and subtask components
No website injection capability is declared. — manifest.json:top-level fields
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores task names, subtasks, subjects, completed-task history, timer values, wallpaper choice, and display preferences in localStorage. It does not access cookies, browsing history, bookmarks, or downloads.
Reads and writes todos, subjects, completedTodos, and preferences in localStorage. — static/js/main.4c395651.js:Mi storage hook and Qs settings
Requests none of Chrome's cookies, history, bookmarks, or downloads APIs. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Only tabs is requested. — manifest.json:permissions
Timer sound is bundled rather than captured from the device. — notification.mp3:packaged asset
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No information is sent automatically. Clicking visible blog, shop, survey, Instagram, Unsplash, or upgrade links opens those services, and some MDS links include ordinary campaign parameters.
Contains explicit HTTPS anchors, including MDS utm_source campaign values. — static/js/main.4c395651.js:information and upgrade links
Contains no fetch, XMLHttpRequest, WebSocket, sendBeacon, or Analytics request. — static/js/main.4c395651.js:network primitive review
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads packaged /static assets only. — index.html:script and stylesheet tags
No runtime network client or remote configuration was found. — static/js/main.4c395651.js:network review
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
When a timer reaches zero, the background worker can focus an existing tab whose title contains Countdown or open Chrome's new-tab page and focus its window. This automatic action follows a timer the user started.
Queries tabs and focuses one or creates chrome://newtab/ when the countdown finishes. — service-worker.js:decrementTimer and openOrFocusExtensionTab
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces Chrome's new-tab page. It does not alter search, homepage, proxy, privacy, download, or other-extension settings.
Maps newtab to the packaged index.html. — manifest.json:chrome_url_overrides
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The React application is production-minified and includes substantial third-party UI library code, but its short application logic, literals, browser calls, storage keys, and URLs remain traceable. This appears to be normal bundling rather than concealment.
A roughly 399 KB production bundle combines React libraries and readable application strings. — static/js/main.4c395651.js:entire file
Identifies bundled third-party library licensing. — static/js/main.4c395651.js.LICENSE.txt:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses setTimeout(decrementTimer, 1000), not a string. — service-worker.js:timer logic
No text-to-code sink was found. — static/js/main.4c395651.js:dynamic-code review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Queries tabs only to locate a title containing Countdown and focus it. — service-worker.js:openOrFocusExtensionTab
Requests no history or website access. — manifest.json:permissions
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The hidden checkbox changes React state only; no GA ID, library, beacon, or request exists. — static/js/main.4c395651.js:gaToggle and network review
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies or host access. — manifest.json:permissions
No automatic outbound request path was found. — static/js/main.4c395651.js:network review
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Input handlers update local task state; the only global key handler closes settings on Escape. — static/js/main.4c395651.js:task form and Escape listeners
No clipboard, capture, or website permission is present. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Handles local UPDATE_TIMER actions only. — service-worker.js:runtime.onMessage
Declares no externally_connectable entry or host access. — manifest.json:top-level fields
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Renders fixed promotional anchors only inside the extension page. — static/js/main.4c395651.js:information links
No content scripts can rewrite website content. — manifest.json:top-level fields
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads, or proxy access. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is present. — manifest.json:permissions
Contains no localhost or loopback endpoint. — static/js/main.4c395651.js:URL review
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
No decoded data reaches a code-execution or script-injection sink. — static/js/main.4c395651.js:decoder and execution review
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no externally_connectable, content_scripts, or web_accessible_resources. — manifest.json:top-level fields
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Shows the packaged upgrade card until dismissed and records the result locally. — static/js/main.4c395651.js:focusPlusUpgradeSeen
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Performs one decrement and local message each second until zero. — service-worker.js:decrementTimer
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or website access exists. — manifest.json:top-level fields
Packaged forms save local application data and do not change external form actions. — static/js/main.4c395651.js:task and settings forms