Extension Auditor
Extension Auditor
Sign Up

Web paint

ID: colbejldlbhdkjhdndknbminnlbbkecj

Could be malicious

Supported Languages

๐Ÿ‡ง๐Ÿ‡ฉBengali
๐Ÿ‡ง๐Ÿ‡ทBrazilian Portuguese
๐Ÿ‡ฌ๐Ÿ‡งBritish English
๐Ÿ‡ง๐Ÿ‡ฌBulgarian
๐Ÿ‡ช๐Ÿ‡ธCatalan
๐Ÿ‡จ๐Ÿ‡ณChinese (Simplified)
๐Ÿ‡น๐Ÿ‡ผChinese (Traditional)
๐Ÿ‡ญ๐Ÿ‡ทCroatian
๐Ÿ‡จ๐Ÿ‡ฟCzech
๐Ÿ‡ฉ๐Ÿ‡ฐDanish
๐Ÿ‡ณ๐Ÿ‡ฑDutch
๐Ÿ‡บ๐Ÿ‡ธEnglish
๐Ÿ‡ช๐Ÿ‡ชEstonian
๐Ÿ‡ต๐Ÿ‡ญFilipino
๐Ÿ‡ซ๐Ÿ‡ฎFinnish
๐Ÿ‡ซ๐Ÿ‡ทFrench
๐Ÿ‡ฉ๐Ÿ‡ชGerman
๐Ÿ‡ฌ๐Ÿ‡ทGreek
๐Ÿ‡ฎ๐Ÿ‡ณGujarati
๐Ÿ‡ฎ๐Ÿ‡ณHindi
๐Ÿ‡ญ๐Ÿ‡บHungarian
๐Ÿ‡ฎ๐Ÿ‡ฉIndonesian
๐Ÿ‡ฎ๐Ÿ‡นItalian
๐Ÿ‡ฏ๐Ÿ‡ตJapanese
๐Ÿ‡ฐ๐Ÿ‡ทKorean
๐Ÿ‡ฑ๐Ÿ‡ปLatvian
๐Ÿ‡ฑ๐Ÿ‡นLithuanian
๐Ÿ‡ฒ๐Ÿ‡พMalay
๐Ÿ‡ฎ๐Ÿ‡ณMalayalam
๐Ÿ‡ฎ๐Ÿ‡ณMarathi
๐Ÿ‡ณ๐Ÿ‡ดNorwegian
๐Ÿ‡ต๐Ÿ‡ฑPolish
๐Ÿ‡ต๐Ÿ‡นPortuguese
๐Ÿ‡ท๐Ÿ‡ดRomanian
๐Ÿ‡ท๐Ÿ‡บRussian
๐Ÿ‡ท๐Ÿ‡ธSerbian
๐Ÿ‡ธ๐Ÿ‡ฐSlovak
๐Ÿ‡ธ๐Ÿ‡ฎSlovenian
๐Ÿ‡ช๐Ÿ‡ธSpanish
๐Ÿ‡ธ๐Ÿ‡ชSwedish
๐Ÿ‡ฎ๐Ÿ‡ณTamil
๐Ÿ‡ฎ๐Ÿ‡ณTelugu
๐Ÿ‡น๐Ÿ‡ญThai
๐Ÿ‡น๐Ÿ‡ทTurkish
๐Ÿ‡บ๐Ÿ‡ธUS English
๐Ÿ‡ป๐Ÿ‡ณVietnamese

Extension Info & Metadata

Status
Removed
Version
0.12.6
Size
0.14 MB
Rating
4.8/5
Reviews
116
Users
272,300
Type
Extension
Updated
Jun 12, 2021
Category
7_productivity
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Author
Diana KrievView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
272,300

Draw on any web page. Annotate the web!

Web paint allows you to draw on web pages! Use a powerful image editing tool right in the browser. ===== Features ===== โญ Paint tools: pencil, eyedropper, text, line, arrows, and more โญ Customize tools: size and color โญ Save to file or copy to clipboard (!) Please note: due to security restrictions the tool doesnโ€™t work on Chrome Webstore or system browser pages e.g. Settings.

Item
Type
Severity
Description
<all_urls>
Permission
Critical
This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:โ€ข 15% increase: Older manifest version lacks modern security controls
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2

The extension page CSP explicitly permits `unsafe-eval` and remote script origins tied to Google Analytics, Google Tag Manager, and Google APIs. That combination weakens the normal extension isolation model and creates a path for runtime code evaluation or remote tracking code to be introduced into privileged extension pages.

manifest.json (Line 1)
{  "update_url": "https://clients2.google.com/service/update2/crx",  "background": {    "page": "bg.html"  },  "browser_action": {    "default_icon": "images/icon-48.png",    "description": "__MSG_app_desc__",    "name": "__MSG_name__"  },  "content_security_policy": "script-src 'self' 'unsafe-eval' https://www.google-analytics.com https://www.googletagmanager.com https://*.googleapis.com; object-src 'self'",  "default_locale": "en",  "description": "__MSG_app_desc__",  "icons": {

The content script runs on `<all_urls>` and, on quota errors, clears the page's entire `localStorage` before writing its own snapshot. This is not needed for the stated drawing feature and can silently destroy site data or session state across arbitrary websites, which is a suspicious and overly destructive pattern for a browser extension.

js/inject.js (Line 358)
persistLocalStorage() {  const t = this.canvas.toDataURL();  try {    p.localStorage.setItem(`WP_CRX_STORAGE_SNAPSHOT_${p.location.pathname}`, t)  } catch (e) {    try {      p.localStorage.clear(), p.localStorage.setItem(`WP_CRX_STORAGE_SNAPSHOT_${p.location.pathname}`, t)    } catch (e) {}  }},

By severity

Critical0
High1
Medium5
Low1

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
0.12.62
0.12.55

Files with findings

3 distinct paths โ€” top paths by unique finding count:

  • js/inject.js3
  • bg.js2
  • manifest.json2
S.No.
Category
Severity
File
Summary
Found in Version
1Tracking
high
bg.js (line 1)The `processQueue` function constructs a base64-encoded query-string payload containing the extension's unique runtime ID, the installation action reason (e.g. 'install', 'update'), and a timestamp โ€” formatted as a URโ€ฆ
0.12.5
2Code Injection
medium
manifest.json (line 1)The extension explicitly declares `'unsafe-eval'` in its Content Security Policy, allowing dynamic code execution via `eval()`, `new Function()`, `setTimeout(string)`, etc. For a drawing/paint extension there is no leโ€ฆ
0.12.5
3Other
medium
js/inject.js (line 358)The content script runs on `<all_urls>` and, on quota errors, clears the page's entire `localStorage` before writing its own snapshot. This is not needed for the stated drawing feature and can silently destroy site daโ€ฆ
0.12.6
4Privilege Escalation
medium
js/inject.js (line 1)The content script reads from and writes to `unsafeWindow.CTRL_HIDDEN` and `unsafeWindow.NOTEPAD_INIT`. `unsafeWindow` is a privileged Firefox API that exposes the raw page-level JavaScript execution context, bypassinโ€ฆ
0.12.5
5Remote Code Loading
medium
manifest.json (line 1)The extension page CSP explicitly permits `unsafe-eval` and remote script origins tied to Google Analytics, Google Tag Manager, and Google APIs. That combination weakens the normal extension isolation model and createโ€ฆ
0.12.6
6Unauthorized Data Collection
medium
js/inject.js (line 1)The content script stores a full base64-encoded PNG snapshot of the canvas (which is overlaid on top of the visited page) in the page's `localStorage`, keyed by `WP_CRX_STORAGE_SNAPSHOT_<pathname>`. Because the canvasโ€ฆ
0.12.5
7Unauthorized Data Collection
low
bg.js (line 1)The eyedropper feature calls `captureVisibleTab` to take a full screenshot of the currently active tab, then renders the entire screenshot into a canvas element temporarily appended to the background page's DOM. Althoโ€ฆ
0.12.5
URLs
8
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
www.w3.org/2000/svghttp://www.w3.org/2000/svg
www.w3.org/1999/xlinkhttp://www.w3.org/1999/xlink
www.bohemiancoding.com/sketchhttp://www.bohemiancoding.com/sketch
www.w3.org/1999/xhtmlhttp://www.w3.org/1999/xhtml
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
www.google-analytics.com-https://www.google-analytics.com
www.googletagmanager.com-https://www.googletagmanager.com
*.googleapis.com;-https://*.googleapis.com;

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Showing 1 to 3 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In