Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Web paint

CRITICAL RISKRemoved from Chrome Web Store

Web paint

ID: colbejldlbhdkjhdndknbminnlbbkecj

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

0.13.0

Size

0.14 MB

Rating

4.8/5

Reviews

116

Users

272,300

Type

Extension

Updated

Jun 12, 2021

Publisher Contextual Analysis

Author: Diana KrievView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

272,300

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Draw on any web page. Annotate the web!

Web paint allows you to draw on web pages! Use a powerful image editing tool right in the browser. ===== Features ===== ⭐ Paint tools: pencil, eyedropper, text, line, arrows, and more ⭐ Customize tools: size and color ⭐ Save to file or copy to clipboard (!) Please note: due to security restrictions the tool doesn’t work on Chrome Webstore or system browser pages e.g. Settings.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High1

Medium5

Low1

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.12.6 Code review	2
0.12.5 Code review	5

Extension Version	Code Review Findings
0.12.6	2
0.12.5	5

Files with findings

3 distinct paths — top paths by unique finding count:

js/inject.js3
bg.js2
manifest.json2

S.No.	Category	Severity	File	Summary	Found in Version
1	Tracking	high	bg.js (line 1)	The `processQueue` function constructs a base64-encoded query-string payload containing the extension's unique runtime ID, the installation action reason (e.g. 'install', 'update'), and a timestamp — formatted as a UR…	0.12.5
2	Code Injection	medium	manifest.json (line 1)	The extension explicitly declares `'unsafe-eval'` in its Content Security Policy, allowing dynamic code execution via `eval()`, `new Function()`, `setTimeout(string)`, etc. For a drawing/paint extension there is no le…	0.12.5
3	Other	medium	js/inject.js (line 358)	The content script runs on `<all_urls>` and, on quota errors, clears the page's entire `localStorage` before writing its own snapshot. This is not needed for the stated drawing feature and can silently destroy site da…	0.12.6
4	Privilege Escalation	medium	js/inject.js (line 1)	The content script reads from and writes to `unsafeWindow.CTRL_HIDDEN` and `unsafeWindow.NOTEPAD_INIT`. `unsafeWindow` is a privileged Firefox API that exposes the raw page-level JavaScript execution context, bypassin…	0.12.5
5	Remote Code Loading	medium	manifest.json (line 1)	The extension page CSP explicitly permits `unsafe-eval` and remote script origins tied to Google Analytics, Google Tag Manager, and Google APIs. That combination weakens the normal extension isolation model and create…	0.12.6
6	Unauthorized Data Collection	medium	js/inject.js (line 1)	The content script stores a full base64-encoded PNG snapshot of the canvas (which is overlaid on top of the visited page) in the page's `localStorage`, keyed by `WP_CRX_STORAGE_SNAPSHOT_<pathname>`. Because the canvas…	0.12.5
7	Unauthorized Data Collection	low	bg.js (line 1)	The eyedropper feature calls `captureVisibleTab` to take a full screenshot of the currently active tab, then renders the entire screenshot into a canvas element temporarily appended to the background page's DOM. Altho…	0.12.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.bohemiancoding.com	/sketch	http://www.bohemiancoding.com/sketch
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.google-analytics.com;	-	https://www.google-analytics.com;

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

the panel is huuuge

熊

熊招财·13 Jun 2021

Awesome and useful

Sloane Shepherd·11 Jun 2021

This is a great extension! Although I do recommend a couple things like maybe adding a text highlighter to highlight text with whatever color you want, and I found a bug with text where when you're done and click away/mouse it cuts half of the last letter, I was wondering if you could fix this bug and add a highlight option, please and thank you! (I still recommend this extension!) Sincerely, Isaiah Noller

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Web paint

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews