Is "Strava Feed Filter" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is benign but powerful with 75% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 53/100.
Evidence context: threat category none; evidence quality moderate.

This extension, 'Strava Feed Filter', declares functionality to filter activities on the Strava dashboard feed, which aligns with its name and stated purpose. The manifest.json file triggers a MANIFEST-SENSITIVE-PERM-TABS finding due to the 'tabs' permission declaration. This permission is functionally necessary for the extension's stated purpose—filtering content on the Strava dashboard requires the ability to read and interact with tab content. The tabs permission alone is not malicious; it is a standard capability for content-modifying extensions.

The extension contains 6 network findings in content/injected.js at lines 2633, 2649, 7015, 3344, 3409, and 3453. These are generic NET-FETCH detections that indicate the presence of fetch() calls in the JavaScript code. Crucially, none of these findings reference specific suspicious domains, and the findings_summary shows 0 IoC findings. This means the network activity is not directed at known malicious endpoints or suspicious third-party domains. The fetch calls are consistent with an extension that needs to communicate with Strava's API or its own backend service to implement filtering functionality.

There are no malware signatures, no obfuscation findings, no code-smell findings, and no credential theft indicators in this extension. The developer uses a Gmail address ([email protected]) rather than a corporate domain, which is a minor concern but not inherently suspicious for a small, niche extension. With only 88 users, this is a low-profile tool serving a specific use case.

The strongest counterargument would be that the tabs permission combined with network activity could enable data exfiltration. However, the absence of specific suspicious domains in the IoC findings, the lack of malware signatures, and the alignment between the extension's name, description, and detected capabilities all point to legitimate functionality. If this extension were malicious, we would expect to see suspicious domains in the network findings, obfuscation to hide malicious code, or malware signatures—none of which are present.

Key Reasons

• No malware signatures or obfuscation detected
• Tabs permission is functionally necessary for stated feed filtering purpose
• Network findings are generic fetch calls without suspicious domain targets
• Extension name and description align with detected capabilities
• Zero IoC findings indicating no communication with known malicious endpoints

False Positive Considerations

• Generic fetch detections without domain specificity
• Tabs permission flagged as sensitive but legitimate for content filtering