Is uTab - Unlimited Custom Dashboard safe?
We analyzed uTab - Unlimited Custom Dashboard version 3.6's actual code and gave it a 62/100 trust score. The extension is useful but requests broader…
Bottom line
The extension is useful but requests broader access than necessary and has a meaningful privileged-fetch weakness.
What it can access
It can read all bookmarks and reach every website, though automatic page features are limited to two sites and fit its dashboard purpose. [Q1][Q4]
Security weaknesses
A page-derived address can trigger privileged network requests without origin or private-network checks, creating a risk to local or internal services. [Q19][Q21]
Signs of misuse
It sends bookmark URLs for previews, keeps a persistent random ID, and may open a server-supplied page; no credential theft evidence was found. [Q6][Q8][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests bookmarks, tab interaction, scripting, browser search and access to every URL. Bookmark and preview features explain much of this, but all-site host access is broader than its two automatic website integrations require.
Declares bookmarks, activeTab, search, scripting and contextMenus plus <all_urls> host access. — manifest.json:13-28
Automatic content scripts are limited to Unsplash and Flixel. — manifest.json:33-53
Which websites can it run on, and can it read or change what appears on those pages?
It reads selected image or video elements and inserts a uTab control on Unsplash and Flixel. It does not run automatically across all websites.
Finds the displayed Unsplash image and inserts a uTab background-selection button. — js/unsplash.js:6395-6440, 6510-6555
Finds the selected Flixel iframe/video and inserts a uTab control. — js/flixel.js:6395-6450, 6530-6575
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Application logic reads image attributes and page layout, not input values. — js/unsplash.js:6395-6555
Application logic reads an iframe and video source after a click, not form fields. — js/flixel.js:6395-6575
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads the browser's full bookmark tree and watches bookmark changes. It does not request cookies, history or downloads.
Registers bookmark change listeners and loads the complete bookmark tree. — js/background.js:5539-5551, 5646-5654
Declares bookmarks but not cookies, history or downloads. — manifest.json:13-23
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A user can choose a local PNG or JPEG as a background; the image is resized and stored as a data URL. No location, camera, microphone, clipboard or installed-app access was found.
Processes a user-selected image file into a local data URL. — js/newtab.js:21588-21608
No sensor, clipboard or management permissions are declared. — manifest.json:13-28
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Bookmark URLs are sent to sshot.org to create thumbnails, and typed city-search text is sent to apitime.net. uTab also retrieves its own configuration and background lists.
Places the complete bookmark URL in a request to sshot.org and receives an image preview. — js/background.js:5655-5672
Sends partial city names to apitime.net for timezone suggestions. — js/newtab.js:22170-22191, 22336-22357
Periodically fetches configuration from utab.io. — js/background.js:5580-5589
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads background lists, configuration and an update response that can influence navigation. I found no downloaded JavaScript or other remotely executed code.
Fetches an update response from utab.io and can open the returned URL in a new tab. — js/background.js:5408-5421, 5554-5562
Fetches a remote configuration object every fifteen minutes. — js/background.js:5580-5589
Downloads a JSON list of slider backgrounds. — js/background.js:1403-1411
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On install or update it contacts uTab, and a non-default server response can open a tab without a contemporaneous user click. Other tab actions are tied to dashboard controls.
An install/update fetch flows to chrome.tabs.create when the response is a URL. — js/background.js:5408-5421, 5554-5562
Normal link, bookmark, preview and screenshot operations are message-driven user features. — js/background.js:5437-5528
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces Chrome's new-tab page and invokes the browser's configured search provider when the user submits its search box.
Declares search permission and a new-tab override. — manifest.json:13-23, 59-61
Passes the user's query to chrome.search.query. — js/newtab.js:20050-20060
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application is shipped as large Webpack bundles with Vue, Axios and compatibility libraries. It is mechanically bundled rather than deliberately hidden, but that format makes review harder.
Contains the dashboard application and third-party packages in one approximately 1.3 MB generated bundle. — js/newtab.js:1-23969
Contains duplicated store and library code alongside the background application. — js/background.js:1-5730
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The matches are global-object and function-polyfill fallbacks inside packaged libraries, not remote-text execution. — js/background.js:4409, 5216
Equivalent matches occur in duplicated packaged library code; application timers receive functions. — js/newtab.js:4622, 6698, 14159
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Automatic website code runs only on Unsplash and Flixel. — manifest.json:33-53
URL transmission is tied to bookmark thumbnail generation rather than tab-history monitoring. — js/background.js:5655-5687
Does it create a persistent ID or browser fingerprint to recognize you?
It creates and persistently stores a random user ID. A legacy background search route would include that ID, although the reviewed new-tab search UI uses chrome.search.query instead.
Generates a random storage.user.id when no ID exists. — js/background.js:5564-5577
A search message route constructs a search.utab.io URL containing the stored uid. — js/background.js:5462-5468
The visible search form calls Chrome's search API rather than the legacy message route. — js/newtab.js:20050-20060
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission is declared. — manifest.json:13-23
Parses a selected iframe response locally for video source URLs and stores the chosen background. — js/flixel.js:6408-6438
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture the visible tab to make a bookmark preview, but only after the user chooses the preview action. It does not monitor typing, forms or the clipboard.
The bookmark editor sends create_bookmark_preview after the user selects that action. — js/newtab.js:19720-19731
Opens the bookmark, injects the preview maker and handles its captureVisibleTab request. — js/background.js:5490-5528
Requests the screenshot, returns the selected preview image and then closes the temporary tab. — js/previewMaker.js:7580-7602
Can a website or remote server send commands that make the extension take actions?
uTab is not a general command-and-control client, but its server can provide a search template and an update-time URL that the extension will navigate to.
Remote config.searchTemplate can replace the legacy search destination. — js/background.js:5459-5468
The response to an update request may be opened as a new tab. — js/background.js:5408-5421, 5554-5562
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Bundled welcome bookmarks use ordinary destination URLs without affiliate parameters. — js/background.js:5690-5730
Injected UI only selects an image as a dashboard background. — js/unsplash.js:6395-6555
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No proxy, webRequest, declarativeNetRequest or downloads permission is declared. — manifest.json:13-28
Can it communicate with software on the computer or services running on localhost?
A clicked Flixel control sends a page-derived iframe URL to the background worker, which fetches it under unrestricted host access without blocking localhost or private-network destinations. The response is processed inside the extension rather than returned to page script.
Uses the selected page iframe src as the fetchBg message URL after a user click. — js/flixel.js:6408-6438
The background message handler fetches t.url without scheme, origin or private-address validation. — js/background.js:5518-5537
<all_urls> gives the background worker broad cross-origin reach. — manifest.json:25-28
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote responses are used as JSON configuration, URLs, images or media markup, not executable payloads. — js/background.js:5400-5687
Can ordinary websites access privileged extension features through messaging or exposed files?
Unsplash and Flixel page access can invoke background actions, and the listener does not validate sender origin or message fields. The most relevant path is Flixel's page-derived URL reaching a privileged fetch.
Installs extension content scripts into two ordinary websites. — manifest.json:33-53
Runtime message handlers perform tab, screenshot and network operations without checking sender.id, sender.url or input schemes. — js/background.js:5437-5537
Static extension resources are exposed to all sites, but no externally_connectable API is declared. — manifest.json:62-75
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior is tied to install/update, periodic configuration, messages and ordinary bookmark events. — js/background.js:5400-5687
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Recurring work is limited to configuration/background refresh and bookmark synchronization. — js/background.js:5400-5687
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Interacts with displayed images and its own inserted button. — js/unsplash.js:6395-6555
Interacts with a displayed iframe/video and its own inserted button. — js/flixel.js:6395-6575