Is "Tab Manager - Organize & Search Tabs" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive.
Risk context: MEDIUM risk, score 64/100.
Evidence context: threat category none; evidence quality moderate.

Tab Manager - Organize & Search Tabs (version 0.5.0) is a Chrome extension claiming to help users manage browser tabs through search, duplicate detection, and bulk closing functionality. The developer is listed as [email protected], an unverified publisher account with zero user count.

The evidence bundle shows 124 total findings, but a detailed examination reveals these are driven entirely by known false-positive patterns. All 103 IoC findings are property access chain artifacts from the XIOC extractor. For example, XIOC-DOMAIN-a.next and XIOC-DOMAIN-t.events in extracted_from_files are not actual network domains but JavaScript property access patterns (like a.next and t.events) misidentified as domains. Other IoCs like XIOC-DOMAIN-i.memoizedprops.style and XIOC-DOMAIN-a.data.map follow the same pattern—these are React/JavaScript property chains, not DNS queries. Per CVEQ guidelines, property access chains misread as domains are documented IoC Extractor Garbage.

The manifest analysis finding MANIFEST-SENSITIVE-PERM-TABS in manifest.json is legitimate—the extension requires tabs permission to perform its stated function of managing tabs. This is expected behavior for a tab manager, not suspicious activity.

Critically, there are zero malware signatures and zero malware findings. There are also zero obfuscation findings. The 19 code-smell findings are low-severity and represent standard JavaScript patterns that trigger YARA rules like postinstall_* and credential_*, which the guidelines classify as noise.

A skeptic might argue that 124 findings and an anonymous publisher warrant concern. However, the nature of these findings—not their count—determines the verdict. Every IoC is a documented false-positive pattern (property access chains), there are no malware signatures, the requested permissions match the extension's functionality, and there's no evidence of credential theft, browser hijacking, or data exfiltration. The zero user count indicates this is a new or unlisted extension, which doesn't indicate malice but does mean there's no community validation.

This extension exhibits no high-confidence threat indicators: no typosquatting, no custom search engines, no credential theft patterns, no malware signatures, and no obfuscation. The findings volume is entirely explained by known false-positive drivers.

Key Reasons

• All 103 IoC findings are property access chain false positives (a.next, t.events, i.memoizedprops.style)
• Zero malware signatures and zero malware findings
• Tabs permission is legitimate for tab management functionality
• Zero obfuscation findings
• Code-smell findings are low-severity YARA noise

False Positive Considerations

• XIOC property access chain misidentification
• YARA code-smell rules on standard JavaScript
• Bundled dependency noise