Is Bookmark Manager and Viewer safe?
We analyzed Bookmark Manager and Viewer version 0.3.8's actual code and gave it a 80/100 trust score. This appears to be a legitimate bookmark manager…
Bottom line
This appears to be a legitimate bookmark manager with moderate access and limited privacy concerns, but its optional broad website access deserves caution.
What it can access
It can manage all bookmarks and, after approval, read clipboard text and fetch saved links; these powers fit the manager but expose sensitive saved URLs. [Q1][Q2][Q4][Q5]
Security weaknesses
Approved broad website access lets user-triggered checks contact saved links, potentially revealing which links were checked and the user's network address. [Q2][Q18]
Signs of misuse
No evidence shows spying, deception, or remote control; outside contact supports bookmark features, though Firefox may send bookmark URLs to Google for icons. [Q6][Q7][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests complete bookmark management, storage, active-tab, favicon, notifications, context-menu, and declarative-content access, plus optional clipboard reading and all-site access. These are broadly appropriate for its manager, validation, RSS, and paste features but expose sensitive saved URLs and destructive controls.
Declares bookmarks and related UI powers plus optional clipboardRead and *://*/*. — manifest.json:permissions, optional_permissions, and optional_host_permissions
Which websites can it run on, and can it read or change what appears on those pages?
It does not inject scripts into sites. After explicit optional permission requests, its own manager page can fetch selected bookmarked URLs to read a title, validate availability, or parse an RSS feed; it does not change those pages.
Requests the selected bookmark origin and fetches its HTML title. — data/panel/toolbar.js:update-title command
Requests all-site access and fetches displayed bookmark URLs to check responses. — data/panel/search.js:validate handler
Declares no content_scripts or scripting permission. — manifest.json:top-level fields
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content script or persistent site access exists. — manifest.json:top-level fields
Parses only the title element from user-selected fetched HTML. — data/panel/toolbar.js:update-title command
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads the complete bookmark tree, including saved URLs, user titles, folders, timestamps, and hierarchy, and stores UI preferences locally. It can also create, update, move, and delete bookmark data.
Calls chrome.bookmarks.getTree and indexes bookmark titles and URLs. — data/panel/search.js:prepare
Reads children recursively and creates or moves nodes. — data/panel/tree.js:tree data and manager actions
Calls remove or removeTree after confirmation. — data/panel/toolbar.js:delete command
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can optionally read clipboard text after the user chooses Paste and grants permission, and can write selected bookmark titles/URLs to the clipboard. It does not access files, location, camera, microphone, or native applications.
Writes selected bookmark representations and requests clipboardRead before reading pasted lines. — data/panel/tree.js:manager.copy and manager.paste
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
User-triggered title refresh, link validation, and RSS expansion contact bookmarked sites. In Firefox only, enabling remote favicon resolution sends full bookmark URLs to Google's favicon service.
Fetches one selected bookmark after an origin permission prompt. — data/panel/toolbar.js:update-title fetch
Fetches listed bookmark URLs in groups after all-site permission approval. — data/panel/search.js:validate handler
Firefox opt-in builds a Google favicon URL with domain_url equal to the bookmark URL. — data/panel/utils.js:utils.favicon
Opens versioned homepage links on install/infrequent update and sets an uninstall feedback URL. — worker.js:FAQs & Feedback
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Parses fetched XML and escapes titles before display. — data/panel/tree.js:RSS data loader
Parses fetched HTML with DOMParser and reads title.textContent only. — data/panel/toolbar.js:update-title
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It can open the developer page on install or an update after 45 days, and registers an uninstall feedback URL. Bookmark creation, editing, opening, validation, clipboard use, and deletion otherwise follow visible user actions, with deletion confirmed.
Creates a homepage tab based on install/update state and sets uninstall URL. — worker.js:FAQs & Feedback
Binds destructive and network operations to buttons and confirmation. — data/panel/toolbar.js:delete and update-title handlers
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Switches only whether the extension action has a popup. — worker.js:mode block
Defines no browser override or management permission. — manifest.json:top-level fields
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable source with project and license links. — worker.js:entire file
Readable bookmark operations and escaping logic. — data/panel/tree.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No text-to-code execution sink was found. — *.js:dynamic-code review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Indexes and fuzzy-searches all bookmark titles and URLs. — data/panel/search.js:prepare and perform
Reads bookmark folders and entries for display. — data/panel/tree.js:tree data loader
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no analytics submission; developer pages are opened as normal tabs. — worker.js:entire file
Storage is limited to manager preferences and no telemetry endpoint exists. — data/panel/*.js:network and storage review
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or webRequest access is declared. — manifest.json:permissions
Uses a basic fetch with only an abort signal. — data/panel/toolbar.js:fetch call
Does it record typing, form entries, clipboard contents, or screenshots?
When the user invokes Paste and grants optional permission, it reads the clipboard as newline-separated bookmark URLs or folder names. It also writes selected bookmarks to the clipboard; it does not monitor typing or capture screenshots.
Uses navigator.clipboard.write and readText in explicit copy/paste commands. — data/panel/tree.js:manager.copy and manager.paste
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or content-script messaging channel exists. — manifest.json:top-level fields
Escapes server-supplied titles and exposes links as bookmark-like entries. — data/panel/tree.js:RSS loader
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content script or page-injection permission exists. — manifest.json:top-level fields
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It does not intercept or rewrite traffic, but explicit validation, title-refresh, and RSS actions issue requests to bookmarked URLs. These requests can reveal the user's IP and that the URL was checked.
Fetches bookmark URLs to classify links as working or dead. — data/panel/search.js:validate handler
Fetches the selected page and reads its current title. — data/panel/toolbar.js:update-title
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission exists; host permission is optional and user-requested. — manifest.json:permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses DOMParser and title.textContent. — data/panel/toolbar.js:update-title
Uses DOMParser and escapes item titles before tree display. — data/panel/tree.js:RSS loader
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable, content_scripts, or web_accessible_resources entry exists. — manifest.json:top-level fields
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses local last-update time solely to rate-limit the help tab. — worker.js:FAQs & Feedback
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Limits validation concurrency to chunks of three URLs. — data/panel/search.js:search and validation
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or scripting permission exists. — manifest.json:top-level fields
Updates bookmark title or URL fields through chrome.bookmarks.update. — data/panel/properties.js:submit handler