Is Free Photo Editor safe?
We analyzed Free Photo Editor version 1.8's actual code and gave it a 80/100 trust score. Free Photo Editor has broad webpage reach and sends…
Bottom line
Free Photo Editor has broad webpage reach and sends user-selected images to its vendor for processing, but the package shows no established spying, abuse, or dangerous remote control.
What it can access
The extension can run on every webpage and show an editing overlay, although reviewed behavior is limited to displaying results. [Q1] It reads a chosen image and sends it to the vendor for processing, which could expose private image contents. [Q5] [Q6]
Security weaknesses
The package requests no browser-setting access or other sensitive browser-data permissions, and no text-to-code execution was found. [Q9] [Q11] Returned content is displayed in the page, but no command-taking or privileged action was found. [Q16]
Signs of misuse
Sending a user-selected image for editing matches the stated feature and is not, by itself, evidence of misuse. [Q6] The review found no tracking, login-information collection, typing or form recording, clipboard harvesting, or screenshot capture. [Q12] [Q14] [Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects a page access into every HTTP/HTTPS page and adds context-menu actions. It declares no access to cookies, history, downloads, or browser settings.
Declares a service worker, an all-URLs content script, contextMenus, and only the vendor host permission. — manifest.json:6-31
Which websites can it run on, and can it read or change what appears on those pages?
The page access can add a fixed overlay to any page. It does not otherwise inspect or rewrite page content in the reviewed package.
Builds an overlay only after receiving the internal dataURL message. — js/content_script.js:1-64
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The all-page script only receives and displays extension messages. — js/content_script.js:1-64
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Does not request browser-data permissions. — manifest.json:1-35
Uses installation, context-menu, tab, messaging, and fetch APIs only. — js/background.js:1-63
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads an image file only after the user selects one and provides a user-triggered copy-to-clipboard action for converted image data.
Reads the selected image with FileReader and submits its Data URL. — js/main.js:1-17
Copies the displayed result after the user clicks the copy button. — js/content_script.js:24-40
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A user-selected image URL or uploaded image is sent to the vendor's service for editing or conversion. This matches the advertised feature, but the image may contain private information.
Places the selected image URL in an editor URL or POSTs it to /index/getFile. — js/background.js:33-45
Defines a form that posts the selected image Data URL to the vendor editor. — index.html:19-25
Populates and submits that form after explicit file selection. — js/main.js:1-17
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses fixed vendor URLs and fetches only an on-demand conversion result. — js/background.js:1-63
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Sets an uninstall URL and opens the vendor install page on first installation. — js/background.js:3-12
Network image actions are context-menu handlers. — js/background.js:33-62
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no override or browser-settings permission. — manifest.json:1-35
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains straightforward event-handler code. — js/background.js:1-63
Contains readable DOM construction and messaging code. — js/content_script.js:1-64
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains no text-to-code execution sink. — js/background.js:1-63
Inserts HTML but does not evaluate it as JavaScript. — js/content_script.js:1-64
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses info.srcUrl only after a context-menu click. — js/background.js:33-45
Requests no history or tabs permission. — manifest.json:24-31
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Sends only the selected image URL in the reviewed network request. — js/background.js:1-63
Handles only the selected image upload. — js/main.js:1-25
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission. — manifest.json:24-31
POST body contains only the selected image URL. — js/background.js:40-55
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers no keyboard, input, submit, or capture listeners. — js/content_script.js:1-64
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Relays the vendor's raw response text to the active tab. — js/background.js:40-54
Places the relayed response into the page DOM with innerHTML. — js/content_script.js:7-10,47-56
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Makes the receiving content script available on all URLs. — manifest.json:12-21
Prepends an overlay and fills it with message data as HTML. — js/content_script.js:47-63
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:24-31
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:1-35
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches response text from /index/getFile and forwards it unchanged. — js/background.js:40-54
Assigns that text to innerHTML. — js/content_script.js:7-10,55-56
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Listens to chrome.runtime messages rather than window.postMessage or DOM events. — js/content_script.js:60-64
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses fixed commands and endpoints without settings reads. — js/background.js:1-63
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains only lifecycle, context-menu, network, tab, and message handling. — js/background.js:1-63
Contains only overlay and copy behavior. — js/content_script.js:1-64
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines the extension popup's own file input and vendor-bound form. — index.html:19-25
Writes the chosen image Data URL only into that extension-owned form. — js/main.js:1-17