Is ScreenTime safe?

Medium risk

ScreenTime sends tracked website hostnames to Google's favicon service when its popup displays usage history.

ScreenTime records the hostname of the active tab and stores per-day browsing duration data in Chrome storage. When you open the popup, it renders the recorded sites and requests icons from Google's favicon service with each tracked hostname in the request URL unless the site has a built-in icon.

Avikam Manglav1.0.13Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

ScreenTime popup sends tracked hostnames to Google's favicon service

ScreenTime's popup shows sites from its tracked browsing history and requests Google favicons for hosts not in its built-in icon list, sending each hostname in the URL to Google and exposing history outside the extension.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens the ScreenTime popup after browsing sites tracked by the extension.

The extension did this

The popup renders recorded hostnames and requests Google favicon URLs for hosts that are not in its built-in icon map.

Captured request
GEThttps://www.google.com/s2/favicons?domain=example.com&sz=32
Fields in the favicon request
  • Browsing hostname
    example.com (illustrative)

    The favicon request includes the site hostname from the extension's recorded browsing activity.

  • Browsing history context
    A site listed in the weekly ScreenTime popup (illustrative)

    A request for a tracked site's favicon reveals that the site appears in the usage history shown by the popup.

What it can do

Permissions this extension asks for, as declared in version 1.0.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Keep running in the background while your browser is open

    background

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Detect when you step away from your computer

    idle

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed ScreenTime contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    ScreenTime sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

Updated 30 September 2026gachmghamoanlighmiebamagipmhdphl