Is Custom Fields for Google Calendar™ safe?

Medium risk

Custom Fields for Google Calendar records its extension panels and sends DOM, URL, page title, and form input events to tglens.tabgraf.com.

The extension loads a session recorder in its popup and Google Calendar iframe panels. The recorder captures DOM replay events, click and key counts, page URL and title, browser metadata, and unmasked form input from those extension UI surfaces, then posts batches to tglens.tabgraf.com/api/ingest.

Tabgrafv10.6.0Chrome Web Store
45Risk
Who publishes it

Tabgraf Technologies LLP - 4 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Tabgraf
Declared legal entity
Tabgraf Technologies LLP
Registered address
Plot No F-27, Lane No 13, Nandighosh Habitat, BJB Nagar, Bhubaneswar, Odisha 751014, IN
Registered contact
Hari Shankar Das
Website
tabgraf.com/contact

Same store account

4 other listings published from this account, 24k+ users between them. 3 of them carry a finding.

chat-plus-%E2%80%94-all-in-one-pr10k+MediumSpecial Characters: Unicode Symbols & Special Characters Picker8k+HighComment Stack - Save Live Chats for YouTube™5k+MediumLogify1k+Low

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

moderncss.dev
Also called by 4 other listings, including Fuel Wallet

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension panel recordings send form input to TabGraf.

Using the popup or injected Google Calendar panels starts an rrweb-style session recording: DOM replay events, form input, page URLs, and page titles, POSTed to tglens.tabgraf.com/api/ingest.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens or interacts with the extension popup or injected Google Calendar panels.

The extension did this

The extension records UI replay events, including form input and page context, and sends recording chunks to TabGraf.

Captured request
POSThttps://tglens.tabgraf.com/api/ingest
Fields in the request
  • Page DOM content
    <div class="custom-field">Team notes</div> (illustrative)

    DOM replay events can reveal what appeared inside the extension UI during the recorded session.

  • Form input
    Quarterly planning notes (illustrative)

    Input sampling is configured for all fields with masking disabled, so typed values can be transmitted.

  • Page URL
    https://calendar.google.com/calendar/u/0/r/eventedit (illustrative)

    The page URL provides context about where the extension panel was used.

  • Page title
    Google Calendar - Event details (illustrative)

    The title can expose the active page or workflow associated with the recorded UI session.

Where it sends data

Destinations our analysis observed Custom Fields for Google Calendar™ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • tglens.tabgraf.com

    Custom Fields for Google Calendar™ sends data to tglens.tabgraf.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026fgomfahnlnkadfcbnlbfddbdfhckbamm