Is daily.dev | Where developers discover what's next safe?
We analyzed daily.dev | Where developers discover what's next version 3.47.5's actual code and gave it a 62/100 trust score. This is a legitimate…
Bottom line
This is a legitimate developer-news extension, but optional browsing access and page-address tracking deserve caution.
What it can access
Default access fits a new-tab news product, but optional all-site page access, bookmark/top-site reading, and framing changes are substantial [Q1][Q5][Q18].
Security weaknesses
Optional embedded browsing removes protections that normally stop pages being framed, although the change is limited to daily.dev embedding and cleaned up afterward [Q18].
Signs of misuse
When Companion is enabled, it sends eligible page addresses to daily.dev and links activity with a persistent device ID, which is meaningful browsing tracking [Q12][Q13][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
Its default permissions are narrow, but optional features can grant all-sites scripting, top-sites and bookmark reading, and response-header modification.
Default access is scripting plus daily.dev and dailynow.co hosts; topSites, bookmarks, declarativeNetRequestWithHostAccess, and all-site hosts are optional. — manifest.json:16-32
After optional all-site access is present, it dynamically registers Companion content scripts on eligible HTTP and HTTPS pages. — js/background.bundle.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It replaces the new-tab page and, when Companion is enabled, can add a fixed daily.dev discussion overlay to ordinary webpages.
Overrides Chrome's new-tab page with the packaged index.html application. — manifest.json:45-47
Creates a daily-companion-app element with a Shadow DOM and injects the packaged Companion interface when the background supplies related post data. — js/content.bundle.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The small all-sites loader reads the URL, creates the Companion host element, watches navigation, and exchanges extension messages; it does not query forms or inputs. — js/content.bundle.js:1
Renders daily.dev posts, comments, and controls inside the extension's Shadow DOM rather than reading host-page form values. — js/companion.bundle.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Does not declare the cookies permission. — manifest.json:16-32
daily.dev API requests may use normal request credentials for the publisher's own signed-in service, but no chrome.cookies enumeration or unrelated-site cookie extraction is present. — js/background.bundle.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
With explicit optional permission it can read top sites or bookmark names and URLs to import shortcuts; it has no camera, microphone, files, or native-app access.
Declares topSites and bookmarks as optional permissions. — manifest.json:25-32
Permission-gated import screens call chrome.topSites.get and chrome.bookmarks.getTree, then let the user choose links; the bookmark UI says bookmarks are never synced to the server. — js/newtab.bundle.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends account and product activity, persistent device identifiers, and—when Companion is enabled—the current eligible page's path and query string to daily.dev.
Builds origin + pathname + search for eligible tabs and supplies it as the url parameter to https://api.daily.dev/boot/companion. — js/background.bundle.js:1
Uses daily.dev GraphQL and telemetry paths for Companion activity and includes device or account context. — js/companion.bundle.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
daily.dev's boot and GraphQL responses provide feature flags, settings, account state, and related content that change the interface, but are not executed as code.
The /boot response supplies settings, user state, encrypted experiment-feature data, and Companion postData used by the packaged application. — js/background.bundle.js:1
The packaged new-tab client uses server content, flags, and account configuration to build the feed and enable product features. — js/newtab.bundle.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Its packaged new-tab app runs whenever a new tab opens; enabled Companion checks run on eligible page loads and URL changes.
Starts a background service worker and makes index.html the new-tab page. — manifest.json:42-47
Notifies the background when loaded and uses a MutationObserver to repeat the Companion check after same-page URL changes. — js/content.bundle.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces the browser's new-tab page with daily.dev, which is the product's advertised purpose; it does not change search, proxy, homepage, or other extensions.
chrome_url_overrides maps newtab to index.html. — manifest.json:45-47
Declares no search-provider, proxy, privacy, management, debugger, or homepage-setting capability. — manifest.json:1-87
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The roughly 14.8 MB unpacked extension uses large minified webpack bundles, which makes independent review harder.
Records 14,817,328 unpacked bytes and large minified application, Companion, and CSS bundles. — inventory.json:1
The approximately 2.5 MB Companion application is emitted as a minified single-line bundle with many included libraries. — js/companion.bundle.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The bundled animation expression engine constructs an _expression_function string and passes it to eval. — js/lottieReact-0b33d164.bundle.js:1
Extension pages use script-src 'self' without 'unsafe-eval', which should block eval in extension-page contexts. — manifest.json:33-35
Does it track the websites, pages, searches, or links you visit?
When Companion is enabled, it observes eligible browsing destinations and sends each full path and query to daily.dev; many sensitive and local sites are excluded.
Constructs the current URL without its fragment and calls the companion boot endpoint with it. — js/background.bundle.js:1
Skips non-HTTP pages, localhost, IP literals, .local/.localhost/.test/.internal hosts, daily.dev itself, and an explicit list of sensitive services. — js/background.bundle.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent device ID and combines it with account identity and experiment or product events sent to daily.dev.
Creates and retrieves a persistent device identifier from extension IndexedDB for boot and messaging context. — js/background.bundle.js:1
Analytics and experiment exposure events can include user_id, device_id, experiment ID, variation ID, and timestamps. — js/newtab.bundle.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The optional Companion sends full eligible page paths and query parameters to daily.dev, where they may be linked to a device or account; it does not send page bodies or forms in the reviewed path.
Passes the tab's origin, pathname, and search string to the remote Companion boot API. — js/background.bundle.js:1
The loader supplies the URL to the extension background but has no code that extracts page text, form fields, or credentials. — js/content.bundle.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests none of the clipboard, desktopCapture, tabCapture, audioCapture, videoCapture, or nativeMessaging permissions. — manifest.json:16-32
The all-sites code contains no keyboard, input, clipboard, canvas capture, or media-capture collection path. — js/content.bundle.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable or nativeMessaging capability. — manifest.json:1-87
Handles internal runtime messages from packaged extension components; no runtime.onMessageExternal handler was found. — js/background.bundle.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates a fixed extension-owned Shadow DOM host; it does not rewrite links, results, advertisements, or existing page nodes. — js/content.bundle.js:1
Displays daily.dev posts, comments, and controls within that isolated Companion panel. — js/companion.bundle.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
After a clear optional permission prompt, embedded browsing removes CSP and X-Frame-Options from HTTP(S) subframe responses in one daily.dev tab so sites can be framed.
The permission screen says embedded browsing will modify response headers and applies only to pages embedded by daily.dev. — js/frame.bundle.js:1
Adds a session declarativeNetRequest rule scoped to one tab and sub_frame resources that removes Content-Security-Policy and X-Frame-Options; cleanup runs on disable, page hide, tab close, or permission removal. — js/background.bundle.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Eligibility rejects localhost, bracketed hosts, IPv4 literals, and hosts ending in .local, .localhost, .test, or .internal. — js/background.bundle.js:1
Does not request nativeMessaging. — manifest.json:16-32
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Decrypts boot experiment-feature JSON and passes the parsed features to packaged GrowthBook code; it does not evaluate the result. — js/background.bundle.js:1
The confirmed eval belongs to the packaged animation-expression library, with no reviewed network response feeding the expression value. — js/lottieReact-0b33d164.bundle.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
daily.dev pages bridge a small fixed set of requests into the extension, and the frame-embedding flow uses origin-checked postMessage commands.
The content script on daily.dev pages bridges requests to open the packaged new tab or request frame-embedding permission; Chrome still presents the permission prompt. — js/ping.bundle.js:1
Accepts frame control only when the parent is the extension or an approved daily.dev/fylla origin and validates message origin, source, and type. — js/frame.bundle.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The Companion boot response contains postData, settings, user state, and feature configuration used by the advertised product. — js/background.bundle.js:1
The site overlay is created only when the packaged background returns normal Companion content; no hidden time, identity, or victim-targeted execution branch was found. — js/content.bundle.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, vpnProvider, nativeMessaging, socket, or broad background-network permission. — manifest.json:16-32
Long-running work is limited to product boot, dynamic content-script management, API requests, updates, and temporary frame rules. — js/background.bundle.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The all-sites loader changes only its own daily-companion-app element and does not query or mutate host form, input, action, or formAction properties. — js/content.bundle.js:1
Inputs belong to the extension-owned Companion interface inside Shadow DOM rather than to the host page. — js/companion.bundle.js:1