Is Tabox - Save and Share Tab Groups safe?
Tabox ships a hardcoded Google OAuth client secret and Drive API key inside its extension package.
The extension bundles an api-keys.json file containing a Google OAuth client_secret and a Google Drive API key in plain text. Any user who installs the extension can read these credentials directly from the package. The client secret is used alongside each user's Google refresh token when the extension requests new access tokens from Google's OAuth endpoint.
Who publishes itTabox - no other listings under this identity
Tabox - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 4.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 4.2.5, which we have not unpacked yet.
Read and change your data on www.googleapis.com
https://www.googleapis.com/
Read and change your data on oauth2.googleapis.com
https://oauth2.googleapis.com/
See the address and title of every tab you have open
tabs
Read and change your tab groups
tabGroups
Store data in your browser
storage
Read and restore your recently closed tabs and windows
sessions
Sign you in with your Google account
identity
Store an unlimited amount of data in your browser
unlimitedStorage
Add items to the right-click menu
contextMenus
Read information about your displays
system.display
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed Tabox - Save and Share Tab Groups contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.googleapis.comwidely used
Tabox - Save and Share Tab Groups sends data to www.googleapis.com. A widely used service: 48 other extensions we have analyzed send data here.
- oauth2.googleapis.com
Tabox - Save and Share Tab Groups sends data to oauth2.googleapis.com. 13 other extensions we have analyzed send data here.