Is ColorZilla safe?
We analyzed ColorZilla version 4.1's actual code and gave it a 78/100 trust score. ColorZilla appears purpose-aligned and shows no established abuse, but…
Bottom line
ColorZilla appears purpose-aligned and shows no established abuse, but its access to every website warrants caution.
What it can access
It can inspect and temporarily change pages on every website, capture visible page images for user-requested color sampling, and store preferences. [Q1] [Q2] These capabilities fit its advertised page-color tools, but the all-website scope is substantial. [Q1]
Security weaknesses
The broad all-website access means a compromise could expose or alter content on pages the user visits. [Q1] [Q2] The package is partly minified, which makes review harder, although no concrete dangerous hidden behavior was established. [Q10]
Signs of misuse
The review found no evidence that it collects typed data, cookies, browsing history, or inspected page data, or sends such information elsewhere. [Q3] [Q12] [Q14] Its external communication is limited to ColorZilla pages and version information, consistent with its stated purpose. [Q6]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, scripting, storage, offscreen processing and access to every website. Those powers support its eyedropper, screenshot and CSS-analysis features, but create substantial access if the extension is compromised.
Declares tabs, scripting, storage, offscreen and <all_urls>. — manifest.json:33-42
Uses script injection, visible-tab capture, tab messaging and local/session storage for the advertised tools. — js/background-combo.js:28
Which websites can it run on, and can it read or change what appears on those pages?
On demand it can inspect the active page's elements, class and ID names, computed colors and styles, capture the visible pixels, and add temporary UI or highlight classes.
The page analyzer walks body and every descendant, records computed color properties and element identifiers, and can add highlight classes. — js/content-script-combo.js:36
Injects the content bundle into the selected tab and captures the visible tab as a PNG for sampling. — js/background-combo.js:28
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
getPageColors reads style properties and element names, with no access to input values or typed content. — js/content-script-combo.js:36
The shortcut listener reports only a modifier combination and letter key code, not general typing. — js/global-shortcut.js:10
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads active and open-tab URLs to inject tools and handle restricted pages, and stores preferences and color history locally. It does not access cookies, browsing history, bookmarks or downloads.
Enumerates existing windows/tabs and injects the shortcut listener into HTTP pages; uses local/session storage for options and colors. — js/background-combo.js:28
No cookies, history, bookmarks or downloads permission is declared. — manifest.json:33-42
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write a selected color to the clipboard and use Chrome's user-triggered system eyedropper, but it does not read clipboard contents or access files, location, camera, microphone or installed applications.
Copies generated color strings with execCommand and invokes EyeDropper.open only from the popup command. — js/popup.js:10
No file, location, camera, microphone, clipboard-read or management permission is declared. — manifest.json:33-42
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It opens first-party ColorZilla help/product pages and automatically opens a welcome page containing browser and extension version information after install or update; it does not upload inspected page data.
Constructs a colorzilla.com welcome URL with browser type/version and previous/current extension versions, then opens it when the stored version changes. — js/background-combo.js:28
User-selected help, versions, localization, homepage and gradient commands open colorzilla.com pages. — js/popup.js:10
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The only XHR loads packaged /js/palette-db.json. — js/popup.js:10
Fetches only runtime.getURL resources from its own package and opens remote pages as normal tabs. — js/background-combo.js:10, 28
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It injects a keyboard-shortcut listener into existing and newly completed HTTP tabs and opens a welcome tab after installation or version changes without a separate prompt.
injectScriptsIntoExistingTabs and tabs.onUpdated place global-shortcut.js into ordinary web tabs. — js/background-combo.js:28
showWelcomePageIfNeeded opens a ColorZilla welcome URL when the stored version differs. — js/background-combo.js:28
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-settings, search or proxy permission is present. — manifest.json:33-42
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package contains minified application bundles and established jQuery, Underscore and jPicker libraries. This reduces readability but does not show deliberate concealment.
Combines minified third-party libraries with labeled ColorZilla modules and copyright headers. — js/content-script-combo.js:1-73
Packaged jQuery 3.6.3 is minified third-party code. — lib/jquery.js:1-2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The library contains the generic globalEval/script-insertion helper shipped with jQuery. — lib/jquery.js:2
Search and call-flow review found no globalEval/eval/new Function use; timers receive function callbacks. — js/background-combo.js:1-28
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Tab URLs are checked for HTTP before injecting packaged shortcut code; no URL log or transmission exists. — js/background-combo.js:28
No history permission is requested. — manifest.json:33-42
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Persistent storage contains version, user options and color history rather than a generated user/device ID. — js/background-combo.js:28
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Screenshot data and sampled colors move only through internal extension messages and session/local storage. — js/background-combo.js:28
No cookies permission is present, and code review found no external upload request. — manifest.json:33-42
Does it record typing, form entries, clipboard contents, or screenshots?
It captures the visible tab for user-requested color sampling and can write a selected color to the clipboard. It does not collect typing, form values or clipboard contents, and the screenshot remains local.
takeScreenshot calls tabs.captureVisibleTab and sends the PNG data URL to the selected tab for pixel sampling. — js/background-combo.js:28
copyToClipboard writes a supplied color string through a temporary textarea; it never reads existing clipboard content. — js/browser-utils.js:10
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable declaration exists. — manifest.json:1-54
Runtime handlers process internal operation names, with no onMessageExternal or onConnectExternal listener. — js/background-combo.js:28
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Page changes are limited to ColorZilla UI, temporary highlight classes, outline CSS and optional body positioning during sampling. — js/content-script-combo.js:36
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads or proxy permission is declared. — manifest.json:33-42
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
nativeMessaging is absent, and reviewed URLs contain no localhost endpoint. — manifest.json:33-42
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Script injection names fixed packaged files or serializes fixed local functions; there is no decoder-to-execution flow. — js/background-combo.js:28
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes css/content-style.css and images/* to <all_urls>. — manifest.json:44-52
No externally_connectable rule accompanies the resources. — manifest.json:1-54
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior depends on user commands, browser capability, tab lifecycle and saved options, not identity, locale targeting or remote flags. — js/background-combo.js:28
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
getPageColors loops over body and all descendants, reads multiple computed color properties and sorts element records. — js/content-script-combo.js:36
This scan begins only when the user chooses the webpage color analyzer. — js/popup.js:10
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The analyzer reads style data and applies ColorZilla-specific highlight classes; it does not alter forms or their destinations. — js/content-script-combo.js:36