Is Sidebarr - Bookmarks, Apps and more safe?

Medium risk

Sidebarr is medium risk. After Sidebarr is installed, the background script posts extension metadata and the stored UUID to sidebarr.org/api/config/. Dynamic analysis observed the request; the code merges every server JSON key into the extension config.…

Sidebarv2.1.4Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote Configuration Is Applied After Install

After Sidebarr is installed, the background script posts extension metadata and the stored UUID to sidebarr.org/api/config/.

Dynamic analysis observed the request; the code merges every server JSON key into the extension config.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install or start the extension.

The extension did this

The background script requests remote configuration and applies returned settings to local behavior.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://sidebarr.org/api/config/
HTTP 200 observed during dynamic analysis. Verification evidence recorded a filters parameter containing base64-encoded JSON with id, version, timestamp, and uid.
Headers
Content-Typeapplication/x-www-form-urlencoded
03EvidenceFIELD TABLE
Fields sent in the configuration request
FieldValueWhy it matters
Extension ID
afdfpkhbdpioonfeknablodaejkklbdnTells sidebarr.org which Chrome extension is asking for configuration.
Extension version
2.1.4Lets the server return settings for the installed release.
Stored browser ID
2fb6e4ea-dcf5-2e5f-a456-f7ee6d15254bLets the server associate configuration checks with the same browser profile over time.
Request time
2026-07-13T12:08:30.515ZShows when this browser profile asked for new configuration.
04EvidenceCODE COMPARE
The code that does this

The code that posts configuration data and applies the response

What it actually does
Readable updateConfig methodbackground.bundle.js
key: "updateConfig",
value: function() {
  var e = this;
  fetch(this.configUrl, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body: "filters=" + encodeURIComponent(btoa(JSON.stringify({
      id: chrome.runtime.id,
      version: this.version,
      timestamp: Date.now(),
      uid: this.config.uid
    })))
  }).then((function(e) {
    return e.json()
  })).then((function(t) {
    if (t) {
      for (var r in t) e.config[r] = t[r];
      e.saveConfig(e.config)
    }
  })).finally((function() {
    if (e.config.configUpTime && e.config.configUpTime > 0) {
      var t = function(e) {
        return e / 6e4
      };
      chrome.alarms.clear("updateTimer"), chrome.alarms.create("updateTimer", {
        delayInMinutes: t(e.config.configUpTime),
        periodInMinutes: t(e.config.configUpTime)
      })
    }
  }))
}
05EvidenceTHIRD PARTY LIST
External host controlling configuration
  • sidebarr.org

    Returns JSON configuration values that the extension stores and uses for future scheduling.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-319
SourceAI SANDBOX

AI Chat Prompts Are Posted With a Persistent UUID

Code analysis shows a Sidebarr AI chat prompt goes from the background script to chat.sidebarr.net/api/generate with model, prompt, a streaming flag, and the stored UUID in an X-Client-UUID header.

Confirmed from code, not captured traffic.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You submit a prompt in the extension's AI chat feature.

The extension did this

The extension posts your prompt to Sidebarr's chat server with a persistent UUID header.

02EvidenceFIELD TABLE
Fields in the chat generation request
FieldValueWhy it matters
Your chat prompt
Summarize this page for meThe text you type into the AI chat box is sent to the chat service.
Persistent browser ID
2fb6e4ea-dcf5-2e5f-a456-f7ee6d15254bLets the chat service associate prompts from the same browser profile.
Model name
gpt-oss:20bTells the service which AI model the extension selected for the response.
Streaming flag
trueTells the service to send the answer back in streamed chunks.
03EvidenceCODE COMPARE
The code that does this

The content script forwards the prompt and UUID to the background script

What it actually does
Readable prompt handlercontentScript.bundle.js
var H = function() {
  var e = Yn(Gn().mark((function e(n, r) {
    var t, o, i, a, s, l, c, f;
    return Gn().wrap((function(e) {
      for (;;) switch (e.prev = e.next) {
        case 0:
          return n.preventDefault(), y(!0), t = {
            type: "user",
            text: r
          }, T((function(e) {
            return [].concat(Xn(e), [t])
          })), E(""), o = [].concat(Xn(A), [t]), i = sr(o), e.next = 9, or("uuid");
        case 9:
          a = e.sent, s = a.uuid, l = ar(), T((function(e) {
            return [].concat(Xn(e), [{
              type: "bot",
              text: ""
            }])
          })), c = chrome.runtime.connect({
            name: "sidebarr"
          }), f = !1, c.onMessage.addListener((function(e) {
            if (e.requestId === l)
              if ("delta" === e.type) T((function(n) {
                var r = Xn(n),
                  t = r[r.length - 1];
                return r[r.length - 1] = {
                  type: "bot",
                  text: ((null == t ? void 0 : t.text) || "") + e.text
                }, r
              }));
              else if ("error" === e.type) T((function(n) {
              var r = Xn(n);
              return r[r.length - 1] = {
                type: "bot",
                text: e.message
              }, r
            }));
            else if ("done" === e.type) {
              f = !0, y(!1);
              try {
                c.disconnect()
              } catch (e) {}
            }
          })), c.postMessage({
            type: "generate",
            requestId: l,
            uuid: s || "",
            model: "gpt-oss:20b",
            prompt: i
          }), c.onDisconnect.addListener((function() {
            f || y(!1)
          }));
        case 18:
        case "end":
          return e.stop()
      }
    }), e)
  })));
  return function(n, r) {
    return e.apply(this, arguments)
  }
}()
04EvidenceCODE COMPARE
The code that does this

The background script posts the prompt to chat.sidebarr.net

What it actually does
Readable generate requestbackground.bundle.js
fetch("https://chat.sidebarr.net/api/generate", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Client-UUID": r.uuid || ""
  },
  body: JSON.stringify({
    model: r.model,
    prompt: r.prompt,
    stream: !0
  }),
  signal: o.signal
})
05EvidenceTHIRD PARTY LIST
External host receiving chat prompts
  • chat.sidebarr.net

    Receives AI chat prompts, selected model names, stream flags, and the X-Client-UUID header.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Install Telemetry Sends a Persistent UUID

When Sidebarr starts after installation, it creates a persistent UUID, saves it, and sends install telemetry to sidebarr.org.

Dynamic analysis decoded the query value to an install event with uid 2fb6e4ea-dcf5-2e5f-a456-f7ee6d15254b.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension.

The extension did this

The extension creates a persistent UUID and sends it with an install telemetry event.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://sidebarr.org/api/action/
HTTP 200 observed during dynamic analysis. The request used a p query parameter that decoded to action=install and uid=2fb6e4ea-dcf5-2e5f-a456-f7ee6d15254b.
03EvidenceFIELD TABLE
Fields in the install telemetry event
FieldValueWhy it matters
Persistent browser ID
2fb6e4ea-dcf5-2e5f-a456-f7ee6d15254bLets sidebarr.org recognize the same browser profile across extension sessions.
Extension ID
afdfpkhbdpioonfeknablodaejkklbdnIdentifies which Chrome extension installation is reporting the event.
Extension version
2.1.4Tells the server which release of the extension is installed.
Lifecycle action
installTells the server that this browser profile just installed or updated the extension.
Event time
2026-07-13T12:08:30.515ZRecords when the lifecycle event happened in the browser.
04EvidenceCODE COMPARE
The code that does this

The code that creates the UUID and sends the lifecycle event

What it actually does
Readable processQueue methodbackground.bundle.js
key: "processQueue",
value: function() {
  for (; this.queue.length > 0;) {
    var e = this.queue.shift();
    if (!e.type || "action" != e.type) return !0;
    var t = "p=" + encodeURIComponent(btoa(JSON.stringify({
      id: chrome.runtime.id,
      v: this.version,
      action: e.action,
      uid: this.uid,
      t: Date.now()
    })));
    fetch(this.actionUrl + "?" + t).then((function(e) {
      return e.json()
    })).then((function(e) {
      e.url && chrome.tabs.create({
        url: e.url
      })
    }))
  }
}
Readable generateUID methodbackground.bundle.js
key: "generateUID",
value: function() {
  return "xxxxxxxx-xxxx-2xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (function(e) {
    var t = 16 * Math.random() | 0;
    return ("x" == e ? t : 3 & t | 8).toString(16)
  }))
}
05EvidenceTHIRD PARTY LIST
External host receiving the identifier
  • sidebarr.org

    Receives extension lifecycle telemetry with the persistent UUID and extension metadata.

What it can do

Permissions this extension asks for, as declared in version 2.1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Read and change your bookmarks

    bookmarks

  • Run its own code inside the pages you visit

    scripting

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See the address and title of every tab you have open

    tabs

  • Schedule its own background tasks

    alarms

favicon
Updated 30 September 2026afdfpkhbdpioonfeknablodaejkklbdn