Chrome Tabs Activity Planner

AI Security Review

Evidence context: threat category none; evidence quality strong.

The Chrome Tabs Activity Planner extension (v0.0.4) generates 121 total findings, but all evidence points to systematic false positives rather than actual threats. The 52 IoC findings are entirely artifacts of the XIOC extractor misreading JavaScript code as network destinations. For example, chrome.sidepanel.open is a legitimate Chrome API call for opening side panels, not a domain. Findings like date.now, b.id, ev.id, timeline.style.top, and event.date are property access chains and JavaScript methods that the extractor incorrectly parsed as domain names. The single URL finding http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia references a legitimate IPTC metadata standard, not a malicious endpoint.

The 68 code-smell findings are classified as low-severity and match known noise patterns. No malware signatures (0), no obfuscation (0), and no network findings (0) were detected. The only substantive finding is MANIFEST-SENSITIVE-PERM-TABS in manifest.json, which declares the tabs permission. This permission is functionally necessary for an extension that saves links as calendar events and provides sidebar navigation, matching the stated description: "Save links as events, organize activities, and jump back to any page instantly."

The developer email [email protected] is unverified and the extension has only 5 users, which are weak signals but not evidence of malicious intent. The extension name does not impersonate any known brand, and there is no typosquatting pattern.

The strongest counterargument would be the anonymous publisher combined with 121 total findings. However, finding count is explicitly unreliable per CVEQ documentation—confirmed false positives average risk scores of 83.2 due to IoC volume and code-smell inflation. The nature of every finding here is documented XIOC garbage: property access chains, API calls, and legitimate URLs. Without malware signatures, obfuscation, or actual suspicious domains, the high finding count is meaningless. The extension's behavior aligns with its description, and no evidence suggests intentional harm.

Key Reasons

• All 52 IoC findings are XIOC false positives (property access chains, JS methods misread as domains)
• Zero malware signatures detected
• Zero obfuscation findings
• Tabs permission is functionally necessary for calendar/link-saving functionality
• Single URL finding references legitimate IPTC metadata standard

False Positive Considerations

• XIOC-DOMAIN property access chain misidentification
• JavaScript method names parsed as domains (date.now)
• Chrome API calls misidentified as network destinations (chrome.sidepanel.open)
• Code-smell rules matching generic patterns

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 85%.