Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Screenshot Tool & Editor

CRITICAL RISKRemoved from Chrome Web Store

Screenshot Tool & Editor

ID: dmlkkmfpebdgkmbclabknmcnaanlbfbf

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.3

Size

0.08 MB

Rating

4.3/5

Reviews

Users

142,118

Type

Extension

Updated

Apr 27, 2021

Publisher Contextual Analysis

Author: yaroslava.kovrigina87View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

142,118

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Crop, Print, Download your screenshots

Screenshot tool extension allows you to make a quick and high quality screenshot of webpage, crop it and even instantly print. This extension may come in handy if you want to share some important info with friends or colleagues, make quick instructions etc. Screenshot tool is simple but very useful extension that doesn`t weigh a lot and will always be reliable. You can help us to improve our product and leave your comment or request. One click download of the image and simple extension interface – that`s what you get after installing screenshot tool. Simple as that!

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High2

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2 Code review	4

Extension Version	Code Review Findings
1.2	4

Files with findings

2 distinct paths — top paths by unique finding count:

scripts/background/background.js3
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	manifest.json (line 1)	The manifest explicitly enables 'unsafe-eval' in the Content Security Policy, allowing dynamic code execution via eval(), new Function(), and similar constructs. Combined with <all_urls> and tabs permissions in a back…	1.2
2	Unauthorized Data Collection	high	scripts/background/background.js (line 28)	The call to env.tabs.query({}) with an empty filter enumerates ALL open tabs across every window, not just the active tab. This gives the background script access to the full list of URLs currently open in the user's …	1.2
3	Unauthorized Data Collection	high	scripts/background/background.js (line 28)	captureVisibleTab combined with the <all_urls> permission allows the extension to silently capture screenshots of any website the user visits, including banking, email, or other sensitive pages. While triggered by a b…	1.2
4	Obfuscation	medium	scripts/background/background.js (line 1)	All functions in the background script use meaningless, randomized-looking names (altarma, renolama, polkatrona) inconsistent with the rest of the codebase's naming. The same pattern appears in other scripts (gelbalda…	1.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Worked fine for most of the time, does what it says. BUT.... It hijacked my search engine and now everytime i do a search it changes it to Yahoo. DO NOT USE

Rob Craddock·2 May 2021

Not cool. This extension doesn't respect the search engine configured as the default in the address bar. Automatically changes it to Yahoo. I'm reporting this extension as "abusive". https://youtu.be/Ba5NcvoSsGI

Erik·2 May 2021

From all the reviews everybody is doing ima delete it

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Screenshot Tool & Editor

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating