Extension Auditor
Extension Auditor
Sign Up

ScreenShot Capture & Editor Tool

ID: haiidfhfnmfmicpakjjkibpcdoolnbbo

Could be malicious

Extension Info & Metadata

Status
Removed
Version
1.2.7
Size
0.37 MB
Rating
4.8/5
Reviews
4,466
Users
330,512
Type
Extension
Updated
Mar 12, 2021
Category
7_productivity
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Author
ScreenShot ToolView Profile
MX records exist
No
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
No
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
330,512

Innovative screenshot tool lets users capture and edit any images that show up on their screens!

Take stunning screenshots of entire websites and capture page elements. Offline. No registration. ScreenShot Tool - captures entire websites and user areas. Why waste time if you just want a screenshot? FEATURES: ✔️Screenshot of the full page, not just the visible area ✔️ Screenshot with one-click ✔️ Storage and processing without a server ✔️ Save PNG files with one click ✔️ No login or registration required ✔️ There are no restrictions on the size or size of the file ✔️ Edit and discard changes ✔️ Add graphic and text elements such as pointer, arrow, square and other shapes Click on the extension icon (in the upper right corner of the browser) and watch the ScreenShot Tool capture each part of the page and then transfer the finished screenshot to a new tab, where you can edit the image and upload it as a file to your PC. Privacy & Terms use ——— We do not collect, store, use, transfer, or sell your personal information. In addition, we do not monitor your behavior on the Internet, do not monitor your actions and do not collect the web pages that you visit in accordance with our policy. We are also categorically against selling your searches to third parties and displaying ads in the app. Notes ——— Remember to reload the page after you install this extension before trying to take a screenshot of it (Chrome should initialize the extension for each page). The extension is completely free and easy to manage for users. If our extension is useful to you, please give us 5 stars!

Item
Type
Severity
Description
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestBlocking
Permission
Critical
This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
<all_urls>
Permission
Critical
This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Dangerous Permission Combination
Risk Factor
Critical
This extension can intercept, modify, and block web requests in real-time.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2

By severity

Critical6
High2
Medium2
Low0

Versions scanned

Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.2.62
1.2.48

Files with findings

2 distinct paths — top paths by unique finding count:

  • background.bundle.js9
  • editor.bundle.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Data Exfiltration
critical
background.bundle.js (line 3917)The webNavigation listener `p` reads response headers from loaded pages and extracts covert C&C commands. It searches for specific header names (obfuscated as c.ulv, c.nul, c.end), then decodes their values using base…
1.2.4
2Data Exfiltration
critical
background.bundle.js (line 3956)The extension injects hidden iframes into the background page, sequentially setting `iframe.src` (obtained via `c.csr.substring(0,3)` = 'src') to attacker-controlled URLs from the decoded C&C config (`a.status.info[].…
1.2.4
3Network Interception
critical
background.bundle.js (line 28)A blocking webRequest.onHeadersReceived listener is registered on ALL HTTP and HTTPS URLs ('http://*/*', 'https://*/*') with the 'blocking' flag. While it returns headers unmodified in this build, the blocking listene…
1.2.4
4Network Interception
critical
background.bundle.js (line 3952)This code manipulates browser navigation targets: it sets `l[i.end]` (the `redirectUrl` property in a webRequest blocking response) to a URL constructed by appending query parameters from the C&C config (`c.qsp`, `c.p…
1.2.4
5Obfuscation
critical
background.bundle.js (line 3767)The C&C config is decoded using a recursive base64 decode helper: `o` applies `atob` repeatedly, and `a` finalises with JSON.parse. `Object(e.b)(Object(e.a)(), JSON)` resolves to `JSON.parse` by using the obfuscated C…
1.2.4
6Remote Code Loading
critical
background.bundle.js (line 3869)After a 4-minute delay (240,000ms), the extension reads all _locales/*/messages.json files, filters them by a character-code modulo rule, concatenates the 'const.message' and 'let.message' fields (keys absent from vis…
1.2.4
7Obfuscation
high
background.bundle.js (line 3805)All Chrome extension API calls are routed through this string-based property traversal function `s()`, where the actual API names are stored in opaque short-key constants (e.g. c.bro, c.err, c.br, c.byt). This complet…
1.2.4
8Obfuscation
high
background.bundle.js (line 3987)The extension uses `chrome.runtime.getPackageDirectoryEntry` to enumerate and read every `_locales/*/messages.json` file within its own package. The returned data is passed to the C&C initializer where specific fields…
1.2.4
9Network Interception
medium
background.bundle.js (line 30)This registers a blocking `webRequest.onHeadersReceived` listener for every HTTP and HTTPS response, giving the extension visibility into response headers across all sites. The handler currently returns headers unchan…
1.2.6
10Tracking
medium
editor.bundle.js (line 621)This code transmits the current page hostname to Google Analytics and stores a timestamp in localStorage to rate-limit the reporting. For a screenshot extension, leaking visited hostnames to a third party is a form of…
1.2.6
URLs
19
IPv4
1
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
*/*http://*/*
*/*https://*/*
npms.io/searchhttps://npms.io/search?q=ponyfill.
screenshot-tool.net/api/config/https://screenshot-tool.net/api/config/
www.google-analytics.com/collecthttps://www.google-analytics.com/collect
chrome.google.com/webstore/detail/https://chrome.google.com/webstore/detail/
www.w3.org/2000/svghttp://www.w3.org/2000/svg
www.w3.org/1999/xlinkhttp://www.w3.org/1999/xlink
uicdn.toast.com/toastui/img/tui-image-editor-bi.pnghttps://uicdn.toast.com/toastui/img/tui-image-editor-bi.png
www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtdhttp://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
Showing 1 to 10 of 20 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
234.56.147.148
IPv4
-
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In