What our analysis found

Webtime Tracker, used by 90,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by other. It comes from a trusted publisher and was last updated in March 2025.

Key findings

• high· other —The bundled manifest declares manifest_version 2 and includes optional <all_urls> permission, while the published CWS manifest summary indicates manifest_version 3 and omits <all_urls>. This mismatch could indicate a version discrepancy or an incomplete update; it does not in itself prove malice but should be verified.

The extension is a local browser time tracker with no network communication. All data is stored in chrome.storage.local and no outbound requests are made. The innerHTML and appendChild counts are due to extensive templating for charts and tables, typical for a complex UI. The permissions (tabs, idle, storage, unlimitedStorage, optional <all_urls>) are fully justified by the extension's stated functionality and are not abused. The only finding is a manifest mismatch between the bundled manifest (v2, optional<all_urls>) and the published CWS summary (v3, no optional permissions), which is not malicious in this context.