Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: Memory for Chrome

CRITICAL RISK

Memory for Chrome

ID: imlnhbmpcfbnonoabmfkglmepnohkabn

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Active

Version

1.2.0

Size

0.73 MB

Rating

2.5/5

Reviews

Users

7,000

Type

Extension

Updated

Jun 2, 2023

Publisher Contextual Analysis

Author: TimelyView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

7,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Automatically track your time in your chrome-based browser

By capturing every second spent in your browser, Timely stops billable time from falling through the cracks. Report and invoice clients transparently, and use accurate company time data to improve project rates and budgets.

User Growth

Showing data from Feb 09, 2024 to Mar 08, 2025

Versions

-12.5%(-1,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 11 ratings

Average Rating

Current: 2.55 / 5.0+0.25

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High4

Medium1

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.0 Code review	7

Extension Version	Code Review Findings
1.2.0	7

Files with findings

4 distinct paths — top paths by unique finding count:

worker.js4
ajs-destination.js1
auto-track.js1
remoteMiddleware.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	worker.js (line 14837)	The collected per-second tab history (timestamp, browser, page title, full URL) is bulk-POSTed to api.timelyapp.com/1.1/bulk/track in batches of up to 600 entries (MAX_ENTRIES_PER_UPLOAD), with up to 48 hours buffered…	1.2.0
2	Data Exfiltration	high	worker.js (line 14736)	Hard-coded exfiltration endpoint (api.timelyapp.com) that receives the bearer-token-authenticated upload of browsing history. Combined with the once-per-second tab capture, this constitutes the network sink for contin…	1.2.0
3	Remote Code Loading	high	remoteMiddleware.js (line 12)	Bundled Segment Analytics module fetches arbitrary middleware JavaScript files from a remote CDN URL (read from window.analytics._cdn) and loads them into the page where they expose themselves as window[name+'Middlewa…	1.2.0
4	Remote Code Loading	high	ajs-destination.js (line 56)	Segment 'destination' loader fetches third-party integration scripts (e.g. {name}.dynamic.js.gz) from a CDN, then dereferences and invokes window[name+'Loader']() and window[name+'Integration']. This is dynamic remote…	1.2.0
5	Unauthorized Data Collection	high	worker.js (line 14905)	On a once-per-second alarm (SECONDS_BETWEEN_LOGGING_ACTIVE_TAB = 1), the worker queries the active tab and harvests its URL, title, favicon URL, tab-group name, and timestamp. This produces a continuous, fine-grained …	1.2.0
6	Credential Theft	medium	worker.js (line 15407)	Authentication uses a hard-coded opaque magic-string URL (auth/w1nriMh_VTlTIRt5fwkXlwoNvfLoHVaSzIOX9lh0OjQ) and parses the bearer token directly from the redirect URL pathname rather than performing a standard OAuth c…	1.2.0
7	Tracking	low	auto-track.js (line 20)	Segment auto-track plugin intercepts link clicks and form submissions, calls preventDefault, fires a tracking beacon, and only then performs the navigation/submission via window.location.href = href or n.submit(). Thi…	1.2.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


api.vimeo.com	/videos/	https://api.vimeo.com/videos/
www.googleapis.com	/youtube/v3/videos	https://www.googleapis.com/youtube/v3/videos?id=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
cdn.segment.com	-	https://cdn.segment.com
cdn.segment.com	/analytics.js/v1/	https://cdn.segment.com/analytics.js/v1/
jedwatson.github.io	/classnames	http://jedwatson.github.io/classnames
github.com	/js-cookie/js-cookie	https://github.com/js-cookie/js-cookie
lodash.com	-	https://lodash.com/
openjsf.org	-	https://openjsf.org/
lodash.com	/license	https://lodash.com/license

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Timely rocks!

Roni Laukkarinen·29 Feb 2024

Solid time tracking app. This extension is a companion to their full Memory tracker that gives more fine-tuned activity reporting in Chrome. Definitely worth being on a paid plan after trialing it. Been using it for over a year now and I'm really happy with it.

Jordan Ryskamp·9 Feb 2024

This has been extremely helpful for me logging billable hours at my agency as I have ADHD and the usual methods have been very challenging.

Tom Pleasant·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

Memory for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating