What our analysis found

Passlit Openbook, used by 10,000,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by tracking. Its permissions mean it can read and change data on all websites.

Key findings

• medium· tracking —When the user opens the extension panel for the first time on any page, the full window.location.href (including any sensitive query parameters), the current hostname, timestamp, and the list of detected tracker companies are silently POSTed to a automation webhook — a third-party platform () rather than the publisher's own infrastructure. The CWS discloses 'Personally identifiable information' as a collection category, but does not specifically disclose transmission of browsing URLs to third-party services, and users opening the panel to view tracker stats would not reasonably expect their current page URL to be exfiltrated. The A-flag ensures this fires once per page session, so it is not continuous surveillance, but it still sends navigated URLs on every distinct page where the panel is opened.

The extension legitimately blocks known domains via declarativeNetRequest and displays a UI overlay showing detected trackers — fully consistent with its stated purpose. However, at content.:1054, when the user first opens the extension panel on any page, the full window.location.href (not just the hostname), timestamp, and list of detected companies are sent via POST to a webhook () — a third-party automation platform, not. The ML score of 0.04 and clean permhash cluster ( malware) both point toward benign, but the third-party browsing-URL transmission on every panel-open is a genuine privacy concern that the CWS PII disclosure does not clearly cover.