PhoneDrop — Send to Phone via QR Chrome extension security report

PhoneDrop is the fastest way to move a link, a piece of text, or a quote from your desktop browser to your phone. No phone app to install. No account to create. No cloud upload. Click — scan — done. ✦ What it does • Click the toolbar icon → instantly see a QR code for the current tab's URL. Scan it with your phone camera to open the same page on your phone. • Switch to the "Text" tab → type or paste anything. The QR updates live as you type. • Right-click anywhere on a page to send content to your phone: – On selected text → "PhoneDrop: send selection to phone" – On a link → "PhoneDrop: send this link to phone" – On the page background → "PhoneDrop: send this page to phone" • A clean overlay appears on the page with the QR code, a copy button, and a download-as-PNG button. ✦ Why PhoneDrop • Privacy-first by design — the content is encoded directly into the QR code on your computer. Nothing is uploaded, no server-side relay, no analytics. • Works with every phone with a camera — Android, iOS, anything in between. Your phone does not need to install anything. • Cross-platform — works on Windows, macOS, Linux, Chromebook. • Minimal permissions — activeTab, contextMenus, and storage. Nothing else. • Open and auditable — built with standard web technologies. No remote code, no obfuscation. ✦ Great for • Continuing reading on your phone when you find an article on desktop. • Sending an address, phone number, Wi-Fi password, or any short snippet to your phone. • Quickly opening a deeply nested URL on mobile without retyping or signing into a syncing browser. • Sharing a quote with a colleague who is right next to you, without using email or a messaging app. • Travelers, journalists, students, developers — anyone who works on a laptop and reads on a phone. ✦ How it works (privacy summary) PhoneDrop runs entirely inside your browser. When you trigger a share: 1. The extension reads the chosen content (the active tab's URL, your text input, the selection, or the clicked link). 2. The content is encoded into a QR code image right on your computer using a standard, audited JavaScript library. 3. The QR image is shown in the toolbar popup or as an overlay on the current page. PhoneDrop has no backend. It does not contact any external server, collect telemetry, or sync data across devices. ✦ Permissions explained • activeTab — used only to read the current tab's URL when you open the popup, so PhoneDrop can show a QR for that page. • contextMenus — used to register the three "send to phone" right-click items. • storage — used to remember which tab (Page URL / Text) you used last in the popup. Stored locally with chrome.storage.local; never transmitted. • Host access (http(s) on all sites) — used so the content script can render the QR overlay on the page where you right-click. The overlay only appears when you explicitly trigger PhoneDrop from the right-click menu. ✦ Roadmap • Quick "use selection" chip in the popup • A small history of recently shared items • Optional support for images and files via opt-in end-to-end encrypted relay • Reverse direction: scan a phone-generated QR to send from phone to desktop Feedback and ideas are welcome.