Caution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Paint Tool by Painty, used by 20,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by unauthorized data collection. Its permissions mean it can read and change data on all websites.
Key findings
- Medium
Unauthorized Data Collection
The new-tab search box streams the user's raw, in-progress query to [domain withheld] on every keystroke (onInput -> getSuggestionsThrottled, a 100 ms throttle set in created), a host that is neither the publisher's [domain withheld] nor any SaaS a tool would justify. The CWS listing declares no data collection and the privacy policy lives on [domain withheld], so user-typed search content reaching this third party is undisclosed; the submit path itself goes to plain [domain withheld], so this suggestion endpoint is the only reason the third party sees the queries at all.
Analyst notes
Reading all seven code bundles (the five page scripts were absent from the extraction, so I read them from the stored v1.11.1 CRX, whose and fabric. are byte-identical to the bundle), the extension is a coherent Vue + 5.2.0 tool with a new-tab page: no remote code loading, no cookie or credential access, and the <all_urls> document_start content script exfiltrates nothing. The one real issue is:39, where every keystroke typed into the new-tab search box is sent to [domain withheld], a third party unrelated to [domain withheld], while the listing declares no data collection - that corroborates the spamware-cluster note and the malicious permhash cluster, whereas the ML evidence is contradicted in source (the hits are axios, core-js setImmediate, regenerator and a source-map decoder, duplicated across six webpack bundles). Hygiene only, not findings: the new-tab page is installed by redirecting chrome://newtab from instead of declaring chrome_url_overrides (default off at:386 and enabled only by explicit user action in), the unreachable getPreview() carries hardcoded basic-auth credentials for [domain withheld], and top-site hostnames go to the publisher's own [domain withheld] favicon service despite the 'none declared' disclosure.
Paint Tool by Painty Chrome extension security report
ID: obdhcplpbliifflekgclobogbdliddjd
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://thepainty.com/
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Paint tool to draw shapes, add text on web pages in real-time, make a screenshot, and download or share the screenshot with friends.
Read the publisher’s full description
Paint Tool is the perfect tool for anyone looking to express their creativity. Draw on any web page quickly and easily and add a new level of expression to your browsing experience. With Painty tools, you can turn any web page into your canvas. Take your creativity to the next level with our tool. This powerful paint tool allows you to draw on any web page with a variety of tools and colors. Plus, it's lightweight and easy to use, adding a new level of creativity and expression to your browsing experience. With Painty, you can quickly and easily create beautiful illustrations, take notes, and have fun. Simple, easy, and fun to use the Painty app, you can enjoy and learn drawing on this Chrome extension. Our extension has a simple and easy-to-use design. It is not confusing and easily recognizable tool icons (pencil, highlighter, arrows, paint bucket, eraser, and other tools) are used in the app which makes it easy for everyone to use. The best multitool for paint online includes: 🖍️ Pencil - draw a custom line with the selected line width and color. 🖌️ Highlighter - the easiest way to highlight text on any webpage. 🎨 Color Picker - pick a color from the web page or your drawings and use it for drawing. ➖ Line - paint a straight line with the selected line width, transparency, and color. ➡️ Arrow - paint a straight line with an arrow on the end of the selected line width, transparency, and color. 🔗 Polyline - the best way to paint an arbitrary figure. 🔳 Rectangle - draw a rectangle with the selected line width, transparency, and color. 🟡 Circle - draw a circle or an ellipse with the selected line width, transparency, and color. 🔺 Polygon - paint a polygon with the selected line width, transparency, and color. 🔤 Text - add text to the web page with the selected color and transparency. 😀 Emoji - add fun emoji to the web page. 👁️🗨️ Blur - blur sensitive or personal information on screenshots or images. 🧽 Eraser - erase part of your drawings. 🎨 Paint Bucket - fill an area with selected color and transparency. and more! But that's not all - with the Painty New Tab, you can enable additional features such as adding/removing bookmarks and storing saved screenshots. How can I use screenshots? Screenshots aren’t just handy, they’re also revolutionary to getting more work done, faster, they can be extremely helpful when you need to demonstrate something that would otherwise be difficult to explain in words. A screenshot can help you get more work done. 1. Share Does your coworker want your input on a new webpage they’ve put together? Or do they need you to look over a brochure they’re having printed? Instead of writing a lengthy email with edits, take a screenshot and wow your coworker with excellent, efficient feedback. 2. Demonstrate Don’t just tell. Show. Demonstrate exactly what you’re talking about with a screenshot. By using a screenshot that shows exactly what you mean, there’s less chance that you’ll be misunderstood. And that means less confusion, less time explaining, and more time back in your day. For example, explain to a new employee how to log in. Instead of telling them, you can quickly send them a screenshot that they can reference again and again without having to repeatedly ask you. A screenshot with numbered steps is quick to make and easy to understand 3. Show If you’ve ever contacted your IT or Web Support Team to report a bug, you’ve likely been asked to provide a screenshot. That’s because not everyone’s computer is the same. Depending on your machine, the operating system it’s running, and the browser version you’re on, the way something appears for you could be completely different for others. Providing a visual example of what you’re looking at helps others see exactly what’s going on and identify what might be going wrong. Whether you're a student, a professional, or just someone who loves browsing the web, Painty is a must-have extension. You'll have access to an array of advanced annotation tools, including a pencil, highlighter, color picker, arrow, polygon, text, emoji, and more. With Painty, you can easily create informative content by drawing online arrows and shapes that focus on the most significant parts of a text or website. Plus, you can edit the content on the web page or screenshot with the blur, eraser, or paint bucket tools. In short, Painty is an all-in-one tool for anyone who wants to take their web browsing experience to the next level. Try it out today and see for yourself how easy it is to annotate and customize any webpage! We value your feedback! Our team is dedicated to offering you the best Chrome experience possible. If you find our extension helpful, please consider giving it a 5-star rating.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools347,000,000 users
- Application Launcher For Drive (by Google)101,000,000 users
- Chrome Remote Desktop41,000,000 users
- Microsoft Single Sign On36,000,000 users
- Free VPN for Chrome - VPN Proxy VeePN15,000,000 users