Capture It - Easy Screenshot Tool (Full Page, Selected, Visible Area)

The declarativeNetRequest rules unconditionally strip Content-Security-Policy, CSP-Report-Only, and X-Frame-Options response headers from every main_frame and sub_frame on every site (urlFilter: "*"). Removing CSP disables script-source restrictions site-wide, and removing X-Frame-Options enables clickjacking by allowing any site to be framed. The extra removals of recording-quality / recording-watermark / screen-recording headers also indicate intent to bypass anti-recording protections used by streaming/DRM content. This dramatically weakens browser security for all 8,000 users on every page they visit and is far beyond what a screenshot tool needs.

[  {    "id": 1,    "priority": 1,    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "recording-quality",          "operation": "remove"        },        {          "header": "content-security-policy-report-only",          "operation": "remove"        },        {          "header": "recording-watermark",          "operation": "remove"        },        {          "header": "content-security-policy",          "operation": "remove"        },        {          "header": "screen-recording",          "operation": "remove"        },        {          "header": "x-frame-options",          "operation": "remove"        }      ]    },    "condition": {      "urlFilter": "*",      "resourceTypes": [        "main_frame",        "sub_frame"      ]    }  }]

The extension generates a persistent UUID on first run, stores it in chrome.storage.local, and beacons it to capture-it.online/extensionData/v2 every four hours together with the user's keyboard shortcut. This is a stable cross-session device/user identifier sent to a publisher-controlled server, enabling long-term tracking of individual users — functionality unrelated to taking screenshots. The same UUID is also appended to the uninstall URL (chrome.runtime.setUninstallURL(`...uninstall/${uuid}`)), confirming its use as a tracking ID.

const generateUUID = () => {  let id = "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c => {    const r = Math.random() * 16 | 0;    const v = c === "x" ? r : r & 3 | 8;    return v.toString(16);  }));  if (false) {}  return id;};const getUUID = () => __awaiter(void 0, void 0, void 0, (function*() {  const data = yield new Promise((resolve => {    chrome.storage.local.get(["uuid"], (result => {      resolve(result);    }));  }));  if (data.uuid !== undefined) {    return data.uuid;  } else {    const newUUID = generateUUID();    yield chrome.storage.local.set({      uuid: newUUID    });    return newUUID;  }}));const actualData = () => __awaiter(void 0, void 0, void 0, (function*() {        const {          shortcut        } = yield chrome.storage.local.get(["shortcut"]);        const uuid = yield getUUID();        const payload = {          connectStamp: uuid,          activeShortcut: shortcut ? {            code: shortcut.symbol,            symbol: shortcut.symbol[3]          } : null        };        const response = yield fetch("https://capture-it.online/extensionData/v2", {          method: "POST",          headers: {            "Content-Type": "application/json"          },          body: JSON.stringify(payload)        });

region.js, which the content script injects into the page context as a <script> tag, creates a Trusted Types policy named "forceInner" whose createHTML simply returns its input unchanged, then uses it to assign innerHTML from a string built out of an arbitrary postMessage payload (event.data.styles, originating from chrome.storage.local.styles which is read/written by the extension and could be set from messages). The pass-through policy defeats Trusted Types protection on Trusted-Types-enforcing sites (which the rules.json CSP-strip already disables anyway), and the innerHTML sink consumes message data without sanitization — a textbook DOM-XSS / HTML injection pattern wrapped in a content script that runs on every http(s) page.

const shadowDom = document.createElement("div");const uniqElementId = "id" + Math.random().toString(36).slice(2, 8);const overlay = document.createElement("div");const regionOverlay = document.createElement("div");const escapeHTMLPolicy = trustedTypes.createPolicy("forceInner", {  createHTML: to_escape => to_escape});overlay.setAttribute("class", "shadow");regionOverlay.setAttribute("class", "region");shadowDom.id = uniqElementId;shadowDom.setAttribute("data-zxc", "true");shadowDom.setAttribute("style", "display: none;");shadowDom.attachShadow({  mode: "open"});...window.addEventListener("message", (event => {        if (event.data.message === "sendStyles" && event.data.zxc) {          shadowDom.shadowRoot.innerHTML = escapeHTMLPolicy.createHTML(            `<style>${event.data.styles}</style>`);

On uninstall the browser is directed to https://capture-it.online/uninstall/<persistent-uuid>, exfiltrating the per-user tracking identifier together with the uninstall event. This lets the publisher correlate uninstalls to specific installs over time, an unauthorized data-collection pattern not disclosed to users.

chrome.runtime.onInstalled.addListener((details => __awaiter(void 0, void 0, void 0, (function*() {  const uuid = yield getUUID();  chrome.runtime.setUninstallURL(`${"https://capture-it.online/uninstall/"}${uuid}`);  if (details.reason === "install") {    yield chrome.storage.local.set({      styles: DEFAULT_STYLES,      pages: PAGES,      installDate: Date.now()    });    yield chrome.storage.local.set({      nextUpdate: Date.now() + 1e3 * 60 * 60 * 4    });    yield actualData();  }}))));

The content script (which runs at document_start, all_frames, on <all_urls>) injects script/region.js into the page's main world via a dynamically created <script> element on every page load. While the script source is bundled (not remote), the combination of universal early-execution injection + a Trusted-Types-bypassing policy in region.js + the manifest's host-wide CSP-stripping rule lets attacker-controlled chrome.storage values reach innerHTML inside a page-world script context. This is overreach for a screenshot tool that only needs to act when invoked.

const integrate = () => {  if (document.head && document.head.appendChild) {    const region = document.createElement("script");    region.src = chrome.runtime.getURL("script/region.js");    document.head.appendChild(region);    chrome.runtime.sendMessage({      action: "updateDataPls"    });  } else {    setTimeout(integrate, 100);  }};integrate();

Content script is configured to inject into every frame of every http/https page at document_start. For an action-popup-driven screenshot tool there is no need to run before page scripts on every site (including subframes); document_start + all_frames + <all_urls> maximizes the surface for the page-context script injection and Trusted-Types-bypass behavior in region.js, and is the early-execution pattern flagged by the heuristic.

{  "content_scripts": [    {      "matches": [        "http://*/*",        "https://*/*"      ],      "all_frames": true,      "js": [        "script/content.js"      ],      "run_at": "document_start"    }  ]}