AutoFill Snippets Chrome extension security report

AutoFill Snippets is a Chrome Manifest V3 extension that saves reusable text templates (“snippets”) tied to short triggers (shortcuts). Data lives in chrome.storage.local on the user’s machine—there is no sign-in and no extension-operated backend. Core flows: - Create and edit snippets in the toolbar popup: each snippet has a Shortcut (trigger text) and a Template (expanded body). Saving with an existing Shortcut updates that snippet’s template. Snippets are listed with search, per-row Insert on page, and Delete. - Type-to-expand: on pages where the extension’s content script runs, focus a normal text control, type the exact shortcut, then type Space, Tab, or Enter as the delimiter—the trigger plus delimiter is replaced by the expanded template. Supported targets include common INPUT types, TEXTAREA, and many contenteditable regions (for example some site search boxes). Some sites use heavy scripts or non-standard editors where expansion may not run; Insert from the popup or context menu is the fallback. - Insert from popup: focuses the last focused editable control in the active tab when possible (because opening the popup moves keyboard focus), then inserts at the caret using all subframes as needed. - Right-click: on editable elements, choose Insert AutoFill snippet and pick a saved snippet (up to 25 listed; a disabled line notes when more exist—open the extension to access the full list). Template placeholders are replaced at expansion or insert time using the user’s local clock: - {{date}} — YYYY-MM-DD - {{time}} — HH:MM (24-hour, zero-padded minutes) - {{datetime}} — YYYY-MM-DD HH:MM - {{year}}, {{month}}, {{day}} — numeric components (month and day zero-padded to two digits) DuplicateShortcut handling: the same trigger string maps to one snippet; re-saving updates the body. Privacy stance in plain terms: Snippets are stored locally. The extension injects a content script on matched pages to watch typing and to receive insert commands; it does not ship page contents to a remote server. Broad host permissions exist so the extension can message tabs and insert text after a user gesture (toolbar popup or context menu) under Manifest V3 rules. FEATURE SUMMARY (POPUP SECTIONS AND ACTIONS) -------------------------------------------- Header: - Title: AutoFill Snippets - Tagline: Type your shortcut, then Space, Tab, or Enter to expand. Search: - Field placeholder: Search snippets… - Filters the saved list by shortcut or template text (case-insensitive substring match). Composer (“New snippet”): - Shortcut field placeholder: e.g. ;sig or /thanks - Template textarea placeholder: Expanded text… Use {{date}}, {{time}}, {{datetime}} - Hint line lists placeholders and reminds the user about the editable context menu. - Button: Save snippet Saved list: - Heading: Saved snippets, with a count badge when non-empty. - Per snippet: shortcut line, preview of template (collapsed whitespace, max ~140 characters with ellipsis), Insert on page, Delete. - Empty states: “No snippets yet. Add one above.” or “No matches. Try another search.” when search filters everything. POPUP USER INTERFACE STRINGS (FOR CONSISTENCY WITH THE PRODUCT) ---------------------------------------------------------------- (As in popup.html / popup.js; see FEATURE SUMMARY for grouping.) CONTEXT MENU STRINGS -------------------- Parent menu: - Title: Insert AutoFill snippet - Context: editable (Chrome’s “editable” context—inputs, textareas, contenteditable areas) Per-snippet child items: - Title: the snippet’s shortcut text (truncated with ellipsis when longer than 40 characters) When more than 25 snippets exist: - Disabled child: …and N more (open extension)