Is "Rabbithole" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is likely false positive with 80% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 53/100.
Evidence context: threat category none; evidence quality moderate.

The Rabbithole extension demonstrates no evidence of malicious behavior across all analyzed categories. The manifest-analysis finding MANIFEST-SENSITIVE-PERM-TABS in manifest.json identifies the 'tabs' permission, which is directly appropriate for an extension whose stated purpose is to 'Track your internet rabbitholes' — tracking browsing history requires tabs access.

The three network findings are all generic operation detections without suspicious domains: NET-FETCH-assets/modulepreload-polyfill-B5Qt9EMX.js-1, NET-FETCH-assets/browser-BGIZYV9P.js-1, and NET-SOCKET_IO-assets/Update-DNw0be3F.js-16. These file names indicate legitimate functionality: modulepreload polyfills (standard browser compatibility code), browser modules, and update mechanisms. Critically, the findings_summary shows ioc count of 0 — no suspicious domains were extracted from these network calls. The network findings detect the presence of fetch/socket_io calls, not specific destinations.

Zero malware signatures, zero obfuscation findings, and zero code-smell findings indicate clean code. The extension does not exhibit any high-confidence threat indicators: no typosquatting (name is unique), no browser hijacking (no custom search engines or new tab replacement), no credential theft (no login domain IoCs), and no malware delivery disguise patterns.

The strongest counterargument to this verdict would be: 'The developer is listed as an email address ([email protected]) rather than a verified company, and the extension requests sensitive tabs permissions.' However, this counterargument does not override the absence of actual malicious indicators. Anonymous developers are common for small utility extensions, and the tabs permission is functionally necessary for the extension's stated purpose. Without suspicious domains, obfuscation, malware signatures, or deceptive naming, developer anonymity alone does not constitute evidence of malicious intent. The evidence shows expected behavior for a browsing-tracking utility, not exploitation or data exfiltration.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• Network findings detect generic operations without suspicious domains (ioc count = 0)
• tabs permission is appropriate for stated browsing-tracking functionality
• No typosquatting, browser hijacking, or credential theft indicators

False Positive Considerations

• Generic network findings (fetch/socket_io) without suspicious domain extraction
• Expected permissions for stated functionality (tabs for browsing tracking)