[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Toggl Track: Productivity & Time Tracker

Version 4.11.17 View in Chrome Web Store

Last scanned: about 14 hours ago

Extension Details

Developer: Toggl OÜ

Rating: 4.4 ★ (1.5K ratings)

Users: 300,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 6 total findings, including 2 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

alarms
background
contextMenus
idle
notifications
scripting
storage
cookies
offscreen
unlimitedStorage

Optional Permissions:

tabs

Host Permissions:

*://*.toggl.com/*
*://toggl.com/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (73 total):

https://accounts.toggl.com	https://api.track.toggl.com
https://api.plan.toggl.com	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/svg	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xhtml	https://github.com/styled-components/polished/blob/main/src/internalHelpers/errors.md#
https://www.grillitype.com/api/storage/app/uploads/public/60d/347/775/60d347775277d609030995.pdf	https://lodash.com/
https://openjsf.org/	https://lodash.com/license
http://underscorejs.org/LICENSE	https://npms.io/search?q=ponyfill.
https://formatjs.io/docs/tooling/babel-plugin	https://formatjs.io/docs/tooling/ts-transformer
https://formatjs.io/docs/tooling/linter#enforce-id	https://formatjs.io/docs/getting-started/message-distribution
https://formatjs.io/docs/react-intl#runtime-requirements	https://formatjs.io/docs/react-intl/api#intlshape
http://momentjs.com/guides/#/warnings/define-locale/	http://momentjs.com/guides/#/warnings/js-date/
http://momentjs.com/guides/#/warnings/min-max/	http://momentjs.com/guides/#/warnings/add-inverted-param/
http://momentjs.com/guides/#/warnings/zone/	http://momentjs.com/guides/#/warnings/dst-shifted/
http://fb.me/use-check-prop-types	https://fb.me/react-async-component-lifecycle-hooks
https://fonts.googleapis.com/css2?family=Inter:wght@300	https://track.toggl.com/organization/
https://github.com/adobe/react-spectrum/issues/2320	https://fb.me/react-warning-dont-call-proptypes
https://us.i.posthog.com	https://posthog.com/docs/api/overview
https://eu.i.posthog.com	https://assets.track.toggl.com/images/workspace.jpg
https://track.toggl.com?utm_source=toggl-button&utm_medium=referral	https://track.toggl.com/reports?utm_source=toggl-button&utm_medium=referral
https://toggl.typeform.com/to/sI2cCiTE	https://fonts.googleapis.com/css?family=Roboto:300
https://track.toggl.com	https://accounts.toggl.com/track
https://cdn.growthbook.io	https://rt.growthbook.io/?key=
https://app.posthog.com/home#panel=support%3Asupport%3A.	https://github.com/LiosK/uuidv7/blob/e501462ea3d23241de13192ceae726956f9b3b7d/src/index.ts
https://app.posthog.com	https://us.posthog.com
https://sentry.io/organizations/	http://yandex.com/bots
https://accounts.toggl.com/track/login/?returnTo=https://toggl.com/track/toggl-extension-redirect	https://accounts.toggl.com/track/signup/?utm_source=toggl-button&utm_medium=referral&returnTo=https://toggl.com/track/toggl-extension-redirect
http://www.example.com	https://extension.track.toggl.com/api
https://483e628134c9452ab766d443d4d111fc@o43910.ingest.sentry.io/4504061411000320	https://robwu.nl
https://github.com/Rob--W/chrome-api/tree/master/worker_proxy/	https://github.com/Rob--W/chrome-api/blob/master/patch-worker/
http://crbug.com/334408	https://clients2.google.com/service/update2/crx
https://fonts.googleapis.com/css2?family=Inter:wght@400	https://radix-ui.com/primitives/docs/components/
https://addons.mozilla.org/en-US/firefox/addon/toggl-button-time-tracker/privacy/	https://toggl.com/legal/track/terms/
https://support.mozilla.org/en-US/kb/permission-request-messages-firefox-extensions?as=u&utm_source=inproduct	https://assets.track.toggl.space/images/profile.png
https://example.com	https://example.com/image.png
https://example.com/auth	https://support.toggl.com/en/articles/2206984-toggl-track-browser-extension
https://support.toggl.com/en/

Raw Manifest

{
  "name": "Toggl Track: Productivity & Time Tracker",
  "icons": {
    "16": "images/icon-16.png",
    "48": "images/icon-48.png",
    "128": "images/icon-128.png"
  },
  "action": {
    "default_icon": {
      "19": "images/icon-19.png",
      "38": "images/icon-38.png"
    },
    "default_popup": "src/pages/popup/index.html",
    "default_title": "Toggl Time Tracker"
  },
  "version": "4.11.17",
  "commands": {
    "quick-start-stop-entry": {
      "description": "Quick start/stop current entry",
      "suggested_key": {
        "default": "Ctrl+Shift+E"
      }
    }
  },
  "background": {
    "type": "module",
    "service_worker": "sw.js"
  },
  "options_ui": {
    "page": "settings.html",
    "open_in_tab": true
  },
  "short_name": "Toggl Track",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Puts a timer into any web tool and allows quick real time productivity tracking with all the data stored on your Toggl account",
  "permissions": [
    "alarms",
    "background",
    "contextMenus",
    "idle",
    "notifications",
    "scripting",
    "storage",
    "cookies",
    "offscreen",
    "unlimitedStorage"
  ],
  "host_permissions": [
    "*://*.toggl.com/*",
    "*://toggl.com/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "tabs"
  ],
  "externally_connectable": {
    "matches": [
      "*://*.toggl.com/*",
      "*://toggl.com/*"
    ]
  },
  "minimum_chrome_version": "88",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "settings.html"
      ]
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "worker_proxy.html"
      ]
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": []
    }
  ],
  "optional_host_permissions": [
    "<all_urls>"
  ]
}

by ✦ Astarte

Toggl Track: Productivity & Time Tracker

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (73 total):

Raw Manifest

Detections

Manifest Findings