[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Screentime

Version 5.0.8 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Rating: 4.0 ★ (62 ratings)

Users: 10,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a moderate user base of 10,000 users with a decent 4.0-star rating from 62 reviews, suggesting general user satisfaction. However, the lack of clear developer information and company details reduces transparency and accountability. The extension uses Manifest V3, which is the more secure and current standard for Chrome extensions.

Concerns: The primary concern is the tabs permission, which allows the extension to access and manipulate browser tab information. For a screentime tracking extension, this permission makes sense functionally but creates privacy risks as it can potentially monitor all browsing activity. The combination of tabs access with storage permissions means the extension can collect and store detailed browsing data. While notifications and alarms permissions are reasonable for a screentime app to alert users about usage, the tabs permission significantly elevates the risk profile.

Recommendations: Consider running this extension in a separate Chrome profile if you're concerned about privacy, especially if you handle sensitive information in your browser. Review the extension's privacy policy carefully to understand what data is collected and how it's used. Monitor your browsing behavior after installation to ensure the extension functions as expected without unexpected interference. Consider alternative screentime tracking methods that don't require such broad browser access if privacy is a primary concern.

Findings

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
notifications
tabs
alarms

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (347 total):

http://www.w3.org/2000/svg	http://google.com
https://www.some-app-title.com	https://twitter.com/femiodtexe
https://github.com/femioladeji	https://twitter.com/3eyedpixel
https://github.com/fabolaji	https://dribbble.com/femipixels
https://github.com/zloirock/core-js/issues/173	https://code.google.com/p/v8/issues/detail?id=687
https://bugs.chromium.org/p/v8/issues/detail?id=3443	https://github.com/floydpink
https://tc39.github.io/ecma262/#sec-advancestringindex	https://github.com/mirontoli
https://github.com/hinrik	https://github.com/ragnar123
https://github.com/sakarisson	https://github.com/baryon
https://github.com/tc39/proposal-promise-finally	https://github.com/ElFadiliY
https://github.com/abdelsaid	https://github.com/WikiDiscoverer
https://github.com/gaspard	https://github.com/jarcoal
https://github.com/erhangundogan	https://github.com/BYK
https://github.com/mrbase	https://github.com/hagmandan
https://github.com/eillarra	https://github.com/sirn
https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues	https://github.com/nodejs/node/blob/master/lib/internal/crypto/random.js#L48
https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues	https://github.com/milan-j
https://github.com/crnjakovic	https://github.com/Quenty31
https://github.com/alesma	https://github.com/crypto-browserify/crypto-browserify
https://github.com/kikoanis	https://en.wikipedia.org/wiki/Base64#URL_applications
https://github.com/beatgammit/base64-js/issues/42	https://github.com/demidov91
http://praleska.pro/	https://github.com/Oire
https://vue-chartjs.org/guide/#vue-single-file-components	https://github.com/IrakliJani
https://github.com/kyungw00k	https://github.com/ShahramMebashar
https://bugs.chromium.org/p/chromium/issues/detail?id=830565	https://github.com/frontyard
https://github.com/mmozuras	https://github.com/dcodeIO/bcrypt.js
http://nodejs.org/api/crypto.html	http://www.w3.org/TR/WebCryptoAPI/
https://github.com/dcodeIO/utfx	https://tc39.github.io/ecma262/#sec-string.prototype.split
https://tc39.github.io/ecma262/#sec-regexp.prototype-@@split	https://github.com/bangnk
https://github.com/chienkira	https://github.com/miodragnikac
https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is#polyfill
https://www.w3.org/TR/html53/semantics-scripting.html#potentialcustomelementname	https://github.com/facebook/flow/issues/285
https://github.com/vuejs/vuex/issues/1505	https://v2.vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.
https://v2.vuejs.org/v2/api/#data	https://v2.vuejs.org/v2/guide/components.html#data-Must-Be-a-Function
http://www.w3.org/1999/xlink	http://www.w3.org/1998/Math/MathML
https://stackoverflow.com/a/28210364/1070244	https://github.com/paldepind/snabbdom/blob/master/LICENSE
http://www.matts411.com/post/internet-explorer-9-oninput/	https://github.com/vuejs/vue-devtools
https://vuejs.org/guide/deployment.html	https://github.com/wernerm
https://github.com/jjupiter	https://github.com/tc39/proposal-string-pad-start-end
https://github.com/muminoff	http://jsperf.lnkit.com/fast-apply/5

Page 1 of 5

Raw Manifest

{
  "name": "Screentime",
  "icons": {
    "16": "images/icon_16.png",
    "48": "images/icon_48.png",
    "128": "images/icon_128.png"
  },
  "action": {
    "default_icon": "images/icon_128.png",
    "default_popup": "index.html"
  },
  "version": "5.0.8",
  "background": {
    "service_worker": "js/background/main.js"
  },
  "short_name": "screentime",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "To keep track and manage your time on sites that reduce productivity. You can set the number of minutes you want and time frames",
  "permissions": [
    "storage",
    "notifications",
    "tabs",
    "alarms"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  }
}

by ✦ Astarte

Screentime

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (347 total):

Raw Manifest

Detections

Manifest Findings