DOMGrab Chrome extension security report

DOMGrab is a small developer tool for getting HTML out of a page and into your clipboard. Open any web page, click the toolbar button, and pick one of four actions: • Copy full DOM — copies the live, rendered HTML of the whole document, exactly as it stands after scripts have run. Open shadow roots are inlined as declarative <template shadowrootmode> blocks, so the copy is self-contained and can be re-opened or diffed elsewhere. • Pick an element — turns on a picker. Hover to highlight any element and see its CSS selector; click it to copy just that element's HTML. Press Esc to cancel. • Read snapshot — builds a structured JSON summary of the page: title, URL, amount of visible text, headings, up to 80 clickable items (links, buttons, inputs) with their selectors, and up to 40 text blocks. If you have picked an element, the snapshot also describes it: CSS selector, tag, id, classes, attributes, text, and bounding box. • Copy snapshot — puts that JSON on the clipboard. WHY IT EXISTS "View source" gives you the server's HTML, not what the browser actually rendered. DevTools gives you the rendered tree, but copying a large subtree out of it — or feeding a page's structure to a script, a test, or an AI assistant — is fiddly. DOMGrab is two clicks: open, copy. Useful for writing selectors for scrapers and end-to-end tests, filing bug reports with the exact markup attached, saving a rendered page for later comparison, and pasting page structure into an LLM without hand-editing HTML. PRIVACY Nothing is collected, stored, or transmitted. There is no server, no analytics, no account. The extension makes no network requests at all. What it reads goes to your clipboard and to its own popup window, and nowhere else. It also requests no host permissions and installs no background content script. Nothing runs on any page until you click the toolbar button on that page — which is what the activeTab permission means. NOTES • Chrome does not permit extensions to run on chrome:// pages, the Chrome Web Store, or other browser-internal pages; the popup tells you so instead of failing quietly. • To use it on local files, enable "Allow access to file URLs" on the extension's details page. • Only the top frame is collected; cross-origin iframes and closed shadow roots are not readable by any extension.