Is Black List Site 2 safe?

Medium risk

Black List Site 2 records full page URLs, page titles, visit counts, and time spent for sites you visit.

The extension runs a content script on every website and tracks activity such as mouse movement, keypresses, scrolling, and clicks. It stores per-site and per-page browsing records locally, including full URLs, document titles, visit counts, daily buckets, last-visited time, and total time spent.

v2.6.1Chrome Web Store
45Risk
Who publishes it

No other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Website
maitakeramen.hatenablog.com/entry/2019/08/08/203932

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every page you visit gets logged with its full URL, title, and time spent

We observed the extension record the full URL, page title, visit count, and time spent for every site you browse, then store it in local storage, well beyond its blocklist function.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You visit any website with the extension installed.

No blocklist entry or opt-in is needed; the content script runs on every page via an <all_urls> match.

The extension did this

The extension records that page's full URL, title, and how long you stayed, then saves it to local storage.

We captured the same write for both a Wikipedia article and example.com during one browsing session.

When this fires

Every 5 minutes

Logs the open page every 5 minutes it stays visible, again when you close or navigate away from it, and checks for 5+ minutes of inactivity every 30 seconds.

What's stored on your device

Each domain gets a persistent record: page title, running total time, visit count, and daily time buckets kept 62 days.

Location
chrome.storage.local key 'viewing_time_data'
Contents
{  "en.wikipedia.org": {    "pages": {      "https://en.wikipedia.org/wiki/Canary_test_page_12345": {        "daily": {          "2026-09-08": {            "time": 14578,            "visitCount": 1          }        },        "title": "Canary test page 12345 - Wikipedia",        "totalTime": 14578,        "visitCount": 1,        "lastVisited": 1788908287669      }    },    "totalTime": 14578,    "lastVisited": 1788908287669  }}
What gets saved for every page you visit
  • The page's exact web address
    https://en.wikipedia.org/wiki/Canary_test_page_12345

    Stored in full, not just the domain, so the record shows exactly which article, product, or result you opened.

  • The page's title
    Canary test page 12345 - Wikipedia

    The document title is saved alongside the URL, such as an article headline or account page name.

  • Time spent on the page
    14578

    A running total of milliseconds spent on that exact page.

  • Visit count
    1

    How many times you've returned to that exact page.

  • Daily time buckets
    2026-09-08: 14578ms

    A day-by-day breakdown of time spent, kept for 62 days before being rolled into monthly totals.

Observation

This history stays in chrome.storage.local; no off-device transfer was observed. The extension's own dashboard (rebipra.com, localhost) can request it via a page-scoped bridge, limited to the extension's own domains.

Updated 30 September 2026pleijhempjpmjogomoabhibenbjekhlj