Is Delete Tab Groups: Close, Ungroup, Archive, Sort, Dedupe & Group by Domain safe?
We analyzed Delete Tab Groups: Close, Ungroup, Archive, Sort, Dedupe & Group by Domain version 2026.9.26.1's actual code and gave it a 56/100 trust score.…
Bottom line
This is a useful tab-management extension, but its broad tab visibility and unexplained fingerprint telemetry create substantial privacy concerns.
What it can access
It can inspect all open tab addresses and titles for management, while also collecting detailed device characteristics and a persistent installation value [Q1][Q2][Q12][Q13].
Security weaknesses
The trusted sharing page can ask the extension to open up to 500 validated links, so a compromised vendor page could cause unwanted tab creation [Q16][Q21].
Signs of misuse
The extension sends persistent identifiers, detailed device fingerprints, and some settings data to its operator without a normal user-facing opt-out [Q6][Q13][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, tabs and tabGroups plus access only to Windseed's main and sharing sites. Tab authority is broad but directly matches the advertised cleanup, grouping, sorting, archiving and sharing features.
Declares storage, tabs, tabGroups and host access limited to windseed.app and tabs.windseed.app. — manifest.json:14-25
Exposes explicit commands for tab-group cleanup, sorting, archiving, deduplication, movement and restoration. — manifest.json:52-121
Which websites can it run on, and can it read or change what appears on those pages?
It reads tab URLs, titles, group names, state and window placement, then closes, moves, groups or ungroups tabs. It does not read arbitrary page bodies; its only page access runs on Windseed share pages.
Queries tabs and groups, builds overview records containing URL/title/state and executes the advertised tab operations. — src/background.js:1
Restricts page-content code and external website connectivity to tabs.windseed.app share routes. — manifest.json:27-41
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Tab URLs and titles can reveal private searches, document names and services in use. The extension has a complete local path from chrome.tabs queries to its overview, sorting, rules and sharing UI, but cannot inspect typed form values or passwords inside pages.
Normalizes every queried tab with title and URL for overview and management operations. — src/background.js:1
Does not inject page-reading code outside the fixed Windseed share page. — manifest.json:27-36
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares only storage, tabs, tabGroups and two vendor hosts. — manifest.json:14-22
Stores a bounded local recent-tab list to implement user-configured restoration rather than reading Chrome history. — src/recently-active-tabs.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
The share interface can copy a generated share link and download a QR image after a user requests sharing. No clipboard reading, arbitrary file access, location, camera, microphone, screen capture or native-app integration was found.
Copy and QR-download actions are attached to visible share controls after successful encrypted-share creation. — src/popup/share-controller.js:1
Declares no device, clipboard-read, capture, file-system or native-messaging permission. — manifest.json:14-22
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Windseed receives feature results, persistent install/session IDs, detailed browser/device/network characteristics and some changed setting values. Share creation sends AES-GCM ciphertext, IV and expiry to tabs.windseed.app, not plaintext tab URLs or the key.
Queues feature records with install ID, session ID, user agent, timezone, hardware, memory, connection, screen, high-entropy UA data and metadata, then POSTs them to windseed.app/api/events/core-feature. — src/core-feature-events.js:1-3
Uploads only version, ciphertext, IV and expiry; credentials and referrer are omitted. — src/shared/tab-group-share-api.js:1
POSTs user-entered feedback and optional contact email to Windseed after form validation and submission. — src/shared/feedback/submitFeedback.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
Windseed supplies a remote cross-promotion catalog and encrypted share records, while its share page supplies validated URLs to open. These are active data/instruction paths, but no downloaded JavaScript or server text reaches a code-execution primitive.
Fetches and validates a Windseed product catalog and caches vendor-hosted images. — src/shared/cross-promo/products.js:1
Forwards open-shared-tabs data only from the Windseed share page into the extension. — src/share-page-bridge.js:1
Validates shared URLs, count, protocol, length and sender before opening tabs. — src/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Destructive tab cleanup is user-invoked and confirmed by default; pinned tabs and configured groups/rules receive protection. Users can disable confirmation.
Requires confirmation by default for closing grouped, other, collapsed, ungrouped or all tabs, with an explicit skip setting. — src/danger-confirm.js:1
Protects pinned tabs, named groups, colors and group-name rule matches from cleanup. — src/cleanup-protection.js:1
Runs auto-group/sort/dedupe behavior only when normalized user settings enable each feature. — src/background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no search, homepage, proxy, privacy or browser-settings permission. — manifest.json:14-22
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Application files are compacted to long lines but retain descriptive names, constants, services and feature modules. The package is large mostly because of locales, screenshots and fonts.
Shows readable modular JavaScript plus large localization, tutorial image and font assets. — inventory.json:1
Retains named imports and coherent feature-specific functions despite minification. — src/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The Function substring belongs to a QR mask-selection method and does not construct code. — src/vendor/qrcode-generator.js:1
All packaged JavaScript was checked for dynamic-code primitives. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
The tabs permission lets it observe all open tab URLs and titles continuously enough to apply automatic rules and maintain recent-tab restoration. The reviewed telemetry does not send raw open-tab URLs, although user-configured domain-rule values may be reported.
Listens to tab creation, update, activation, movement and removal while reading URL/title/group state. — src/background.js:1
Feature events contain predefined action/settings metadata rather than a general tab-history stream. — src/core-feature-events.js:1-3
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent random install ID and transmits a detailed fingerprint: user agent, platform/version, architecture, model, CPU count, memory, network characteristics, timezone, screen, viewport and language. No ordinary user-facing telemetry opt-out was found.
Creates deleteTabGroupsInstallIdV1 and adds basic plus high-entropy device/browser fields to every queued feature event. — src/core-feature-events.js:1-3
The only disable path checks a session flag named windseedCdpTestDisableEvents or development/test context, not a normal setting. — src/core-feature-events.js:1-3
Does it send cookies, session details, authentication data, or page contents elsewhere?
Plain tab URLs and titles stay local for ordinary management. User-created shares encrypt them before upload, with the key in the URL fragment.
Normalizes titles/URLs and encrypts the JSON payload using a random 256-bit AES-GCM key and 96-bit IV. — src/shared/tab-group-share-crypto.js:1
Places the encryption key after #k= in the share URL, so browsers do not send it in the HTTP request. — src/shared/tab-group-share-api.js:1
Builds settings-change metadata with fromValue/toValue from joined custom domain, group, exclusion and cleanup rule values. — src/options/options.js:1
Accepts those metadata strings and POSTs queued events with credentials include to Windseed. — src/core-feature-events.js:1-3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Injects code only on the vendor share page, not arbitrary forms or editable pages. — manifest.json:27-36
Clipboard use is a user-invoked write of the generated share URL. — src/popup/share-controller.js:1
Can a website or remote server send commands that make the extension take actions?
The Windseed share page can instruct the extension to open and optionally group up to 500 supplied HTTP/HTTPS links. Sender origin/path, protocol, count and length are checked, but a compromised trusted share page could still abuse this capability.
Accepts open-shared-tabs messages only from its own page window and same origin, then forwards URLs and group name. — src/share-page-bridge.js:1
Requires a tabs.windseed.app/s/ sender, validates 1-500 HTTP/HTTPS URLs up to 20,000 characters and then creates tabs. — src/background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Fetches a product catalog and builds sanitized Windseed redirect URLs with source, surface, placement and version metadata. — src/shared/cross-promo/products.js:1
Has no content script on search, commerce or general websites. — manifest.json:27-36
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, webRequest, declarativeNetRequest or downloads permission. — manifest.json:14-22
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission; network destinations are fixed HTTPS Windseed services. — manifest.json:14-22
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Encrypts a defined JSON schema of group name, tab title and URL with AES-GCM. — src/shared/tab-group-share-crypto.js:1
Treats encrypted material as opaque share data rather than executable content. — src/shared/tab-group-share-api.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Only tabs.windseed.app is externally connectable. Its share-page bridge can ask the extension to open validated links, a privileged action.
Restricts the content bridge and externally_connectable surface to tabs.windseed.app. — manifest.json:27-41
External messages share the same strict sender and URL validation before tab creation. — src/background.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Checks normalized auto-group, dedupe, sort, separation and protection settings before each automatic operation. — src/background.js:1
Limits the share-page content script to https://tabs.windseed.app/s/*. — manifest.json:27-36
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Queues up to 1,000 feature events locally and rate-limits server flushes to once per eight hours. — src/core-feature-events.js:1-3
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Injects only the fixed share-page bridge on the vendor share route. — manifest.json:27-36
Handles ping and open-shared-tabs messages, not form manipulation. — src/share-page-bridge.js:1