Is Clock, Alarm, Timer & Stopwatch safe?

Medium risk

Clock, Alarm, Timer & Stopwatch bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames after opt-in.

After the user accepts a 'Help the extension for free' prompt in the popup, the extension opens a connection to ws.mellow.tel and loads URLs chosen by that server in hidden iframes, adjusting frame and CSP headers to do so. On server instruction it can also record the request and response headers and bodies of those pages and post them to a server-supplied endpoint. Nothing in this runs unless the user has opted in.

siegeappbrasilv1.1.8Chrome Web Store
49Risk
Who publishes it

siegeappbrasil - 11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
siegeappbrasil

Same store account

11 other listings published from this account, 1k+ users between them. 10 of them carry a finding.

Image Downloader Assistant - Batch Save Images337MediumUndo Closed Tabs – Reopen Last Tab236MediumAlarm, Timer & Stopwatch for Browser230MediumQR Code Generator & Reader69MediumVideo Speed Controller - Universal Video Playback Speed59MediumMonitix – Stock & Crypto Price Alert & Tracker41Medium5 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

docs.mellowtel.com
Also called by 1 other listing: Edit Anything
endpoint-example.com
Also called by 1 other listing: Edit Anything

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Clock extension SDK loads server-chosen URLs in off-screen frames after opt-in

Code analysis shows that after an in-popup Accept, the bundled Mellowtel SDK connects to ws.mellow.tel and loads server-supplied URLs in off-screen frames, relaying request data to a server-set endpoint.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You click Accept on the 'Help the extension for free' prompt in the popup.

The prompt links to Mellowtel terms and also offers Cancel.

The extension did this

The extension connects to ws.mellow.tel and starts loading pages chosen by that server in off-screen frames.

Requests made from those frames can be reported back to a server-supplied address.

The code that does this

Connection endpoints and opt-in flag in the shipped bundle

Readable version

Endpoints (names restored)

background.js
const WS_URL = "wss://ws.mellow.tel";const APPROVAL_URL = "https://api.mellow.tel/approval";const RECONNECT_DELAYS_MS = [30000, 60000, 300000, 600000, 1200000, 3600000];

Opt-in flag (names restored)

popup.js
const OPT_IN_KEY = "mellowtelOptIn";async function optIn() { await setStorage(OPT_IN_KEY, "true"); return true; }async function optOut() { await setStorage(OPT_IN_KEY, "false"); await disconnect(); return true; }
The code that does this

Header stripping and off-screen frame creation

Readable version

Intent of the rule

background.js
chrome.declarativeNetRequest.updateSessionRules({  removeRuleIds: [ruleId],  addRules: [{ id: ruleId, priority: 1,    action: { type: "modifyHeaders",      responseHeaders: [{ header: "x-frame-options", operation: "remove" }, /* content-security-policy handling follows */] } }]});

Intent of the frame builder

pascoli.js
const frame = document.createElement("iframe");frame.id = frameId;frame.credentialless = true;frame.src = url; // URL supplied by the serverframe.referrerPolicy = referrerPolicy;
Fields the XHR hook packages for the server endpoint
  • Request URL
    https://example.com/api/items?page=2

    The address of each request made inside a off-screen frame.

  • Method and headers
    GET; content-type: application/json

    How the request was made and the request and response headers.

  • Response body
    {"items":[{"id":4121}]}

    The content returned to the off-screen frame.

  • Timestamp and record id
    2026-09-14T10:22:41.118Z; burke_id set by server

    Ties each captured record to a time and a server-issued job.

Destinations named in the code
    • ws.mellow.tel

    WebSocket that delivers URLs to load in off-screen frames.

    • api.mellow.tel

    Approval endpoint polled by the service worker.

    • www.mellow.tel

    Opt-in, settings and uninstall-feedback pages.

    • mjkrxoav2cqz3dtgn6ttcyxeua0mqpul.lambda-url.us-east-1.on.aws

    AWS Lambda URL named in the code as a rendered-content destination.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Clock, Alarm, Timer & Stopwatch contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Clock, Alarm, Timer & Stopwatch sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    Clock, Alarm, Timer & Stopwatch sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

  • mjkrxoav2cqz3dtgn6ttcyxeua0mqpul.lambda-url.us-east-1.on.aws

    Clock, Alarm, Timer & Stopwatch sends data to mjkrxoav2cqz3dtgn6ttcyxeua0mqpul.lambda-url.us-east-1.on.aws. 2 other extensions we have analysed send data here.

Updated 15 October 2026najjeheikebkcgojohngpeapdambdlnh