Is Tab Session Manager safe?
We analyzed Tab Session Manager version 7.4.0's actual code and gave it a 78/100 trust score. This appears purpose-aligned, but it retains sensitive…
Bottom line
This appears purpose-aligned, but it retains sensitive open-tab records and can optionally send them to Google Drive.
What it can access
It can read and retain open-tab URLs, titles, and window details for session management, export them locally, and optionally sync them to Google Drive.[Q1][Q4][Q6][Q12]
Security weaknesses
Imported full URLs can be sent to Google over unencrypted HTTP, and minified code makes complete review harder.[Q6][Q10]
Signs of misuse
No covert misuse is established; browsing records are collected for the advertised feature, while cloud syncing requires user sign-in and activation.[Q6][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, storage, downloads, identity, alarms, and offscreen-document access to save, export, restore, and optionally synchronize browsing sessions. The access generally matches its purpose, but the saved URL and title history can be sensitive.
Requests storage, unlimitedStorage, tabs, downloads, identity, alarms, and offscreen, plus optional Google API access and tab-group support. — manifest.json:permissions, optional_host_permissions
Reads tabs and windows into saved session objects and can export those objects as JSON through the Downloads API. — background/background.js:session serialization and export routines
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or all-sites access; optional host access is limited to https://www.googleapis.com/*. — manifest.json:content_scripts, optional_host_permissions
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content_scripts, no <all_urls> host permission, no DOM-related APIs. — manifest.json:1-40
Session serialization captures tab.url, tab.title, tab.favIconUrl, tab.id, tab.index — no form or input data. — background/background.js:2
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension can read open-tab URLs, titles, and related tab state to save sessions, and it can export those sessions as files through the browser's Downloads system. It does not declare cookies, bookmarks, or history permissions, so the code does not establish access to stored cookies, bookmark lists, or the browser's complete history database.
Declares tabs, downloads, and storage permissions, but not cookies, bookmarks, or history. — manifest.json:5-12
The service worker queries tabs/windows and serializes session data containing tab URLs, titles, and metadata. — background/background.js:2
The export and backup paths create JSON data and invoke the Downloads API. — background/background.js:2
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
With Google sync enabled, it sends complete saved-session JSON, including tab URLs and titles, to the user's private Google Drive app-data folder. Separately, importing a text list of URLs can send each complete imported URL to Google's favicon service over plain HTTP when the icon loads.
Serializes the full session object as application/json and uploads it with the Google Drive v3 multipart API into appDataFolder. — background/background.js:cloud API uploadSession routine
Automatic cloud sync is disabled by default and runs only after Google sign-in and the enabledAutoSync setting. — background/background.js:cloud-sync settings and syncCloudAuto routine
Assigns http://www.google.com/s2/favicons?domain=<encoded full URL> as the favicon for each imported URL, including any path or query text. — options/options.js:URL-list import parser
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
update_url points to clients2.google.com/service/update2/crx (standard Chrome update). — manifest.json:2
No fetch/XHR to remote code sources identified; network calls are limited to Google OAuth/Drive endpoints. — background/background.js:2
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension can save sessions and create backup downloads without a separate click each time when automatic-save or backup settings are enabled. These actions are triggered by alarms and browser lifecycle events, although they are generally established by the user's settings rather than by an unexplained webpage trigger.
The worker registers alarm handling for automatic-save and backup alarm names and performs save/download work from those handlers. — background/background.js:2
Startup, window, and tab lifecycle handlers can invoke configured save or tracking behavior. — background/background.js:2
The alarms, tabs, downloads, and storage permissions support these background operations. — manifest.json:5-12
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The important worker, popup, and options logic is bundled and minified into several very large one-line files without source maps. Targeted behavior can still be traced, but a complete audit is materially harder.
Contains roughly 540 KB of bundled, minified code on one logical line. — background/background.js:1-2
Contains roughly 775 KB of bundled, minified UI code without a packaged source map. — popup/popup.js:1-2
Contains roughly 538 KB of bundled, minified settings and import code without a packaged source map. — options/options.js:1-2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No eval/new Function/string-timer patterns identified in mapped flows. — background/background.js:2
No dynamic code-evaluation patterns identified in mapped flows. — popup/popup.js:2
Does it track the websites, pages, searches, or links you visit?
Saving sessions records the URLs and titles of open tabs, and automatic-save features can periodically retain new snapshots. This is the advertised function, not covert analytics, but it creates a sensitive browsing record.
Builds persistent session objects from open windows and tabs and schedules automatic saves when the feature is enabled. — background/background.js:tab/window serialization and autoSave routines
The tabs, storage, unlimitedStorage, and alarms permissions support this collection and retention. — manifest.json:permissions
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
OAuth flow uses a fixed client_id for Google Drive sync; no device fingerprinting or cross-site tracking ID is generated. — background/background.js:2
No permissions for cookies, network requests to tracking endpoints, or content-script injection that could build a fingerprint. — manifest.json:5-12
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends saved browsing-session details elsewhere when the user enables Google Drive sync: the uploaded JSON includes tab URLs, titles, favicons, and window layout. Text-list import can also disclose each full imported URL to Google's favicon service over unencrypted HTTP.
Creates a Blob from JSON.stringify(session) and uploads it to Google Drive's appDataFolder. — background/background.js:uploadSession routine
Requests drive.appfolder and userinfo.email scopes through interactive Google authorization before synchronization. — background/background.js:OAuth flow
Places the entire imported URL into a plain-HTTP Google favicon query parameter. — options/options.js:URL-list import parser
Does not request cookies or page-content injection access. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no clipboard permission, content script, or page-injection permission. — manifest.json:permissions and content_scripts
Stores browser tab and window metadata, not page DOM values or pixels. — background/background.js:session serialization routines
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No content_scripts, web_accessible_resources, or externally_connectable keys are declared. — manifest.json:1-30
Message handlers (signInGoogle, offscreen_createObjectUrl, etc.) are dispatched from extension-owned pages only; no origin check suggests web-page access. — background/background.js:2
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
All tab/window operations are create, update (URL/title), remove, or query for session save/restore; no DOM manipulation or link rewriting. — background/background.js:2
No content scripts or declarativeNetRequest rules that could alter page content or links. — manifest.json:1-30
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
downloads.download is called with generated .json filenames for session export; no webRequest, declarativeNetRequest, or proxy API usage found. — background/background.js:2
No webRequest, declarativeNetRequest, or proxy permissions are declared. — manifest.json:5-12
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Network calls target accounts.google.com (OAuth) and www.googleapis.com (token/Drive); no fetch/XHR to localhost or 127.0.0.1. — background/background.js:2
No nativeMessaging permission; optional host permission is limited to https://www.googleapis.com/*. — manifest.json:5-12
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Session data is serialized with JSON.stringify and deserialized with JSON.parse; no eval, Function constructor, or remote script loading found. — background/background.js:2
Offscreen document simply JSON-stringifies sessions into a Blob; no obfuscated or encoded payload execution. — offscreen/offscreen.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No content_scripts, web_accessible_resources, or externally_connectable entries exist in the manifest. — manifest.json:1-30
All privileged API calls (tabs, windows, downloads, storage) originate from extension-owned pages, not from web-page context. — popup/popup.js:2
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Activation triggers are onInstalled, onStartup, onAlarm (autoSaveRegular, backupSessions), and tab/window lifecycle events; no user/website/date-based branching. — background/background.js:2
Settings control auto-save frequency and cloud-sync toggles; no remote config fetch or A/B-logic detected. — options/options.js:2
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Workload consists of tabs/windows queries, JSON.stringify for export, and alarm-driven session saves; no Web Workers, WASM, or sustained CPU loops. — background/background.js:2
Offscreen document performs a single Blob creation per message; no persistent computation. — offscreen/offscreen.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content_scripts or web_accessible_resources that could inject form-modifying code into web pages. — manifest.json:1-30
All tab operations are at the URL/title level (tabs.update with url/title); no DOM or form-field manipulation is present. — background/background.js:2