Onetab
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Whenever you find yourself with too many tabs, click the OneTab icon to convert all of your tabs into a list. When you need to access the tabs again, you can either restore them individually or all at once.
When your tabs are in the OneTab list, you will save up to 95% of memory because you will have reduced the number of tabs open in your web browser.
Privacy assurance
OneTab is designed for privacy. Your tab URLs are never transmitted or disclosed to either the OneTab developers or any other party, and icons for tab URL domains are generated by Google. The only exception to this is if you intentionally click on our 'share as a web page' feature that allows you to upload your list of tabs into a web page in order to share them with others. Tabs are never shared unless you specifically use the 'share as a web page' feature.
Additional Benefits
Storing tabs in OneTab can also speed up your computer by reducing the CPU load and memory (RAM) usage of your browser. Even a high-end computer can become sluggish when many browser windows are open, because each open browser window may constantly consume resources.
September 2025 Update: A major new version of OneTab has just been released. It will be rolled out gradually as we become certain that there are no significant bugs we've missed. Please DO NOT uninstall and re-install OneTab to force an upgrade, as this will cause your existing OneTab data to be lost.
Tags
Privacy Practices
Security Analysis — Onetab
Permissions
Code Patterns Detected
External Connections
Package Contents 234 files · 5.3MB
What This Extension Does
OneTab is a browser extension that helps users save memory by converting multiple tabs into a list. It's designed for privacy, but has some permissions that raise concerns.
Permissions Explained
- faviconexpected: This permission allows the extension to display its own icon in the browser toolbar.
Technical: The favicon permission grants access to the browser's icon management system, which could be used for phishing or branding attacks if compromised. - unlimitedStoragecheck this: This permission allows the extension to store an unlimited amount of data on your device.
Technical: The unlimitedStorage permission grants access to the browser's storage system, which could be used for storing sensitive user data or malware if compromised. This is a high-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - storagecheck this: This permission allows the extension to store some amount of data on your device.
Technical: The storage permission grants access to the browser's storage system, which could be used for storing sensitive user data or malware if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - tabscheck this: This permission allows the extension to access and manipulate your open tabs.
Technical: The tabs permission grants access to the browser's tab management system, which could be used for phishing or branding attacks if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - activeTabcheck this: This permission allows the extension to access and manipulate your currently active tab.
Technical: The activeTab permission grants access to the browser's current tab, which could be used for phishing or branding attacks if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - scriptingcheck this: This permission allows the extension to run scripts on your behalf.
Technical: The scripting permission grants access to the browser's script execution system, which could be used for malware or phishing attacks if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - contextMenuscheck this: This permission allows the extension to add custom context menus to your browser.
Technical: The contextMenus permission grants access to the browser's menu management system, which could be used for phishing or branding attacks if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - readingListcheck this: This permission allows the extension to access your reading list.
Technical: The readingList permission grants access to the browser's reading list system, which could be used for phishing or branding attacks if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - tabGroupscheck this: This permission allows the extension to access and manipulate your tab groups.
Technical: The tabGroups permission grants access to the browser's tab group management system, which could be used for phishing or branding attacks if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1 - bookmarkscheck this: This permission allows the extension to access and manipulate your bookmarks.
Technical: The bookmarks permission grants access to the browser's bookmark management system, which could be used for phishing or branding attacks if compromised. This is a medium-risk permission that exceeds what's needed for the stated purpose. ⚠ 1
Your Data
OneTab accesses your open tabs, tab groups, bookmarks, and reading list. It sends data to www.one-tab.com and t2.gstatic.com, but claims not to transmit or disclose any sensitive user data.
Technical Details
Code Findings
The extension uses the charCodeAt function to obfuscate its code, making it harder for users to understand what's happening.
Technical: The extension uses the charCodeAt function in multiple JavaScript files (e.g. contentScript.js) to encode strings and make them harder to read.
💡 Obfuscation is commonly used in legitimate extensions to protect intellectual property or prevent reverse engineering.
The extension uses the Fetch API to send requests to various domains, which is a normal and expected behavior for many extensions.
Technical: The extension uses the Fetch API in multiple JavaScript files (e.g. contentScript.js) to send requests to www.example.com, www.one-tab.com, example.com, t2.gstatic.com, and en.wikipedia.org.
💡 The Fetch API is a standard browser API used for making HTTP requests.
The extension writes data to the clipboard, which could potentially be used for phishing or branding attacks if compromised.
Technical: The extension uses the navigator.clipboard.writeText function in multiple JavaScript files (e.g. contentScript.js) to write data to the clipboard.
💡 Writing to the clipboard is commonly used in legitimate extensions to provide a convenient way for users to share data.
The extension sets up event listeners on form inputs, which could potentially be used for phishing or branding attacks if compromised.
Technical: The extension uses the addEventListener function in multiple JavaScript files (e.g. contentScript.js) to set up event listeners on form inputs.
💡 Monitoring form inputs is commonly used in legitimate extensions to provide a convenient way for users to interact with web pages.
The extension uses cryptographic operations, which is a normal and expected behavior for many extensions that need to protect user data.
Technical: The extension uses the crypto.subtle function in multiple JavaScript files (e.g. contentScript.js) to perform cryptographic operations.
💡 Cryptographic operations are commonly used in legitimate extensions to protect user data or provide secure communication channels.
The extension uses the postMessage function to communicate with other domains, which could potentially be used for phishing or branding attacks if compromised.
Technical: The extension uses the postMessage function in multiple JavaScript files (e.g. contentScript.js) to communicate with other domains.
💡 Using postMessage for cross-origin communications is commonly used in legitimate extensions to provide a convenient way for users to interact with web pages.
The extension sets up event listeners on various elements, which is a normal and expected behavior for many extensions that need to provide user interactions.
Technical: The extension uses the addEventListener function in multiple JavaScript files (e.g. contentScript.js) to set up event listeners on various elements.
💡 Setting up event listeners is commonly used in legitimate extensions to provide a convenient way for users to interact with web pages.
OneTab has some concerning permissions and behaviors, but its stated purpose of saving memory by converting multiple tabs into a list seems legitimate. However, users should be cautious when granting permissions that exceed what's needed for the stated purpose.
