Security Alert: Malware Risk Confirmed

This extension is flagged as malware and the latest analysis also reports severe findings. Remove it immediately if installed.Extension: Screenshot - Webpage Screen Capture

CRITICAL RISKStill available - exercise caution

Screenshot - Webpage Screen Capture

ID: okkffdhbfplmbjblhgapnchjinanmnij

Supported Languages

🇺🇸English

🇷🇺Russian

🇺🇸US English

Extension Info & Metadata

Status

Active

Version

1.4.1

Size

1.90 MB

Rating

4.4/5

Reviews

1,100

Users

50,000

Type

Extension

Updated

Nov 2, 2025

Publisher Contextual Analysis

Trusted

Author: https://screenweb.net/View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

50,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Convenient screenshot tool. Capture, edit and save them to jpeg, gif or png, drop comments and share.

Screenshot is an all-in-one platform for all your needs. Just choose what you need now! This handy tool integrates seamlessly into your browser, providing a quick and efficient way to capture the content you see on your screen. All for Free & No sign in needed! Here are some features: ▸ Whole Page screen capture - No matter how long the page is, you can turn the page into a picture for easy editing and sharing. ▸ Visible Area screen capture - Fast capture the viewable area of the current web page. ▸ Selected Area screen capture - Select and capture anything you want. Our extension is not only feature-rich but also incredibly user-friendly. You'll be capturing screenshots in no time. Best of all, it's completely free, so there are no hidden costs or subscriptions to worry about. If you have any questions, suggestions or feature requests, feel free to submit to our Screeshot team.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-16.67%(-10,000 users)

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 99 ratings+24 (32%)

Average Rating

Current: 4.71 / 5.0-0.29

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium1

Low0

Versions scanned

Showing 1 of 11 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.4.1 Code review	7

Extension Version	Code Review Findings
1.4.1	7

Files with findings

4 distinct paths — top paths by unique finding count:

background/background.js3
content/sm.js2
content/ct.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	content/sm.js (line 114)	A fake jQuery stub exposes a `parseJSON` that silently executes arbitrary JavaScript via `new Function(arguments[0])()` whenever the input is not valid JSON. This script is injected via DOM into every page (see conten…	1.4.1
2	Remote Code Loading	critical	content/sm.js (line 3831)	On every page load, sm.js asks the background for the stored `mf` blob, RC4-decrypts it with the hardcoded key `recorder-screenshot-v3`, then feeds the plaintext to the back-doored `parseJSON` above — any plaintext th…	1.4.1
3	Remote Code Loading	critical	background/background.js (line 113)	Background worker polls for `mfcode` and `mf` payloads using a cache-busting query string and stores the response text into `chrome.storage.local` as `mf`, which is the blob that sm.js later decrypts and executes. The…	1.4.1
4	Network Interception	high	background/background.js (line 202)	The background message handler accepts `udr`/`usr` commands from any runtime message and feeds attacker-supplied `t.data` straight into `declarativeNetRequest.updateDynamicRules`/`updateSessionRules`, letting callers …	1.4.1
5	Privilege Escalation	high	content/ct.js (line 107)	The document_start content script on <all_urls> injects sm.js directly into every page's main JS context and wires a postMessage('tobg')→chrome.runtime.sendMessage bridge. Any script running on any site can now invoke…	1.4.1
6	Tracking	high	background/background.js (line 226)	`jdTask` loads a list of URL-matching rules (`jdRules`) from storage and, when a navigation matches `detailReg`, silently redirects the user's tab to a `target` URL for 5–10 seconds before restoring the original URL. …	1.4.1
7	Unauthorized Data Collection	medium	manifest.json (line 55)	Every file in the extension bundle is exposed as a web-accessible resource to every origin. Combined with the postMessage bridge and the injected sm.js, this makes the extension trivially fingerprintable by any websit…	1.4.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
mozilla.github.io	/localForage/	https://mozilla.github.io/localForage/#definedriver
localforage.github.io	/localForage	https://localforage.github.io/localForage
html2canvas.hertzen.com	-	https://html2canvas.hertzen.com
hertzen.com	-	https://hertzen.com
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
github.com	/zloirock/core-js/blob/v3.30.2/LICENSE	https://github.com/zloirock/core-js/blob/v3.30.2/LICENSE

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Doesn't do what its advertised to be capable of.

shasheedaran prabagaran·26 Jul 2026

Nothing happens why you try to capture and there is no documentation stating where images get saved. It's not the Downloads folder. This all on Windows 11. Removed the extension.

Stuart Wright·15 May 2026

Sometime work and sometime not work

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Malware Risk Confirmed

Screenshot - Webpage Screen Capture

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 11 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating