Is Focus & Productivity Booster safe?

High risk

Focus & Productivity Booster is high risk. The extension installs a network rule for safefocusing.com main-frame, sub-frame, and XHR loads. It strips X-Frame-Options and Referer from matching traffic, so those pages lose a framing header and source-page context.…

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-940
SourceAI SANDBOX

Framing and referrer headers removed for safefocusing.com

The extension installs a network rule for safefocusing.com main-frame, sub-frame, and XHR loads.

It strips X-Frame-Options and Referer from matching traffic, so those pages lose a framing header and source-page context.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension and the background service worker starts.

The extension did this

The extension registers a browser network rule for requests initiated by safefocusing.com.

That rule removes one response header that blocks framing and one request header that identifies the referring page.

02EvidenceFIELD TABLE
Concrete fields in session rule 1
FieldValueWhy it matters
Site that starts the request
safefocusing.comOnly requests started by this site match the rule, so the header changes are tied to that site rather than every site you visit.
Frame-blocking response header
X-Frame-OptionsThis header normally lets a site say it should not be embedded in another page. Removing it can change whether that page can be framed.
Referring-page request header
RefererThis header can show which page led to a request. Removing it strips that source-page context from matching requests.
Affected request types
main frame, subframe, XMLHttpRequestThe rule covers page loads, embedded frames, and background page requests initiated by the matching site.
03EvidenceCODE COMPARE
The code that does this

The shipped bundle and readable source register the same header-removal rule

What it actually does
Readable session-rule registrationbackground.js
chrome.declarativeNetRequest.updateSessionRules({
  addRules: [{
    id: 1,
    priority: 1,
    action: {
      type: chrome.declarativeNetRequest.RuleActionType.MODIFY_HEADERS,
      responseHeaders: [{
        header: "X-Frame-Options",
        operation: chrome.declarativeNetRequest.HeaderOperation.REMOVE
      }],
      requestHeaders: [{
        header: "Referer",
        operation: chrome.declarativeNetRequest.HeaderOperation.REMOVE
      }]
    },
    condition: {
      initiatorDomains: ["safefocusing.com"],
      resourceTypes: [chrome.declarativeNetRequest.ResourceType.XMLHTTPREQUEST, chrome.declarativeNetRequest.ResourceType.MAIN_FRAME, chrome.declarativeNetRequest.ResourceType.SUB_FRAME]
    }
  }],
  removeRuleIds: [1]
});
04EvidenceTHIRD PARTY LIST
Domain named by the rule condition
  • safefocusing.com

    Requests initiated by this host match the session rule that removes the listed response and request headers.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote filter list controls content-script injection

A request to safefocusing.com/filter/ returned HTTP 200.

The code fetches that list, saves it as childSafetyUris, and, with Child Safety on by default, registers icontent.js/css in all frames for hosts from the list.

No body was recorded.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The extension refreshes its settings after the background service worker starts.

The extension did this

It requests a domain list from safefocusing.com and uses the returned hosts to register content scripts.

The scripts are registered for all frames on HTTPS match patterns built from the response.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://safefocusing.com/filter/
HTTP 200 observed during dynamic analysis; no request body was recorded in the available evidence.
03EvidenceFIELD TABLE
Fields that turn the remote list into injection rules
FieldValueWhy it matters
Remote list endpoint
https://safefocusing.com/filter/This address supplies the list that decides which browsing locations receive the extension's page scripts.
Stored host list
childSafetyUrisThe extension saves the returned list locally so later code can decide whether the current site is on that list.
Generated match pattern
https://*.wikipedia.org/* (illustrative)Each returned host is converted into an HTTPS rule that covers that host's subdomains and paths.
Injected files
icontent.js, icontent.cssThese extension files are the page scripts and styles that run when you browse to a matched host.
Frame coverage
allFrames: trueThe rule applies inside embedded frames as well as the top-level page on a matched host.
04EvidenceCODE COMPARE
The code that does this

The shipped bundle fetches the remote list and registers all-frame scripts

What it actually does
Default Child Safety settingbackground.js
const _ = p(te),
  ae = {
    enabled: !0,
    autoBlocks: [{
      name: "Child Safety",
      slug: "childSafety",
      enabled: !0
    }, {
      name: "Social Media",
      slug: "socialMedia",
      enabled: !1
    }, {
      name: "Streaming Services",
      slug: "streamingServices",
      enabled: !1
    }],
    customDomains: []
  },
  ie = async () => {
    const s = await _.storage.local.get("settings");
    return s.hasOwnProperty("settings") ? s.settings : ae
  };
Remote hosts become all-frame content-script rulesbackground.js
async function s(t, g) {
  if (t.length === 0) {
    var l = await chrome.scripting.getRegisteredContentScripts({
      ids: [g]
    });
    l.length > 0 && await chrome.scripting.unregisterContentScripts({
      ids: [g]
    });
    return
  }
  try {
    await chrome.scripting.unregisterContentScripts({
      ids: [g]
    })
  } catch {}
  const f = t.map(b => {
    try {
      const U = b.includes("://") ? b : `https://${b}`;
      return "https://*." + new URL(U).host + "/*"
    } catch {
      return b
    }
  });
  chrome.scripting.registerContentScripts([{
    id: g,
    matches: f,
    allFrames: !0,
    js: ["icontent.js"],
    css: ["icontent.css"],
    runAt: "document_end"
  }])
}
const e = async t => {
  const g = t.customDomains.filter(d => d.enabled).map(d => d.uri);
  await s(g, "customDomains");
  const l = ["facebook.com", "instagram.com", "twitter.com", "youtube.com", "x.com"],
    f = t.autoBlocks.filter(d => d.enabled && d.slug == "socialMedia").length > 0;
  await s(f ? l : [], "socialMedia");
  const b = ["netflix.com", "hulu.com", "hbo.com", "hbo.com", "hbo.com"],
    U = t.autoBlocks.filter(d => d.enabled && d.slug == "streamingServices").length > 0;
  await s(U ? b : [], "streamingServices");
  var R = [];
  try {
    var B = await fetch("https://safefocusing.com/filter/");
    R = await B.json(), await chrome.storage.local.set({
      childSafetyUris: R
    })
  } catch {}
  const X = t.autoBlocks.filter(d => d.enabled && d.slug == "childSafety").length > 0;
  await s(X ? R : [], "childSafety")
};
05EvidenceTHIRD PARTY LIST
Remote host involved in the rule generation path
  • safefocusing.com

    Provides the filter endpoint whose JSON response is used to derive content-script match patterns.

Updated 17 September 2026ekljakmipadncemihdnjamakjflfgnkg