Is Easy Browser Tools Online safe?
We analyzed Easy Browser Tools Online version 1.0.2's actual code and gave it a 42/100 trust score. This extension has narrow page matching but secretly…
Bottom line
This extension has narrow page matching but secretly triggers camera-page actions and reads the resulting image without clearly explaining why.
What it can access
The extension can automatically act within every frame of specially marked HTTPS pages and can open tabs or windows.[Q1] Its demonstrated behavior can trigger a page’s camera workflow and read the resulting image, but capture depends on the page and browser permission.[Q2][Q5]
Security weaknesses
It performs automatic clicks and image handling without a clear user request when the URL marker is present.[Q8][Q22] The camera-related behavior is concealed inside a file presented as a normal library, while the public description does not explain it.[Q10]
Signs of misuse
The extension secretly triggers camera controls and reads a resulting image on matching pages, despite claiming only general browser tools.[Q2][Q10][Q15] No completed path was found sending that image outside the browser, which limits the demonstrated harm.[Q6]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can create tabs and windows and inject a page access into specially tagged HTTPS pages and all their frames.
Requests tabs and windows and registers an all-frame content script for URLs containing the fixed UTM marker. — manifest.json:10-13,26-35
Which websites can it run on, and can it read or change what appears on those pages?
On matching pages, it queries and clicks camera-related controls and reads the resulting image element.
Queries #startbutton, #btnCamFirst, #btnCapture, and #picSave in a timed sequence. — src/inject/jquery.min.3.1.js:2
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads an image data URL from the matched page and encodes it, but no completed remote destination exists in the package.
Reads picSave.src, strips a prefix, base64-encodes it, and sends it internally as emoji. — src/inject/jquery.min.3.1.js:2
Contains no handler for emoji or image data. — src/bg/serviceworker.js:1-21
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests no storage permission. — manifest.json:10-13
Only opens fixed browser pages and windows. — src/bg/serviceworker.js:1-21
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It attempts to drive a page's camera-capture workflow and read the produced image; device access still depends on that page and browser permission.
Automatically clicks elements named for camera start and capture, then reads picSave.src. — src/inject/jquery.min.3.1.js:2
Activates this code automatically on the specially marked URL pattern. — manifest.json:26-35
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Sends the encoded image only through internal runtime messaging. — src/inject/jquery.min.3.1.js:2
Does not accept, store, forward, or upload the image message. — src/bg/serviceworker.js:1-21
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Contains the fixed URL marker. — manifest.json:26-35
Contains the fixed selectors and delays. — src/inject/jquery.min.3.1.js:2
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The hidden click-and-image sequence starts automatically in every frame of a matching URL without a popup action.
Registers the content script automatically with all_frames enabled. — manifest.json:26-35
Starts the timed sequence immediately when the file executes. — src/inject/jquery.min.3.1.js:2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Shows the five labeled shortcut buttons. — popup.html:31-36
Maps fixed messages to fixed chrome:// pages or about:blank. — src/bg/serviceworker.js:2-21
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Undisclosed camera-page automation is concealed at the start of a file presented as an ordinary jQuery library.
The jQuery license header is followed by custom Chrome, camera-selector, image-reading, and window-closing code before the library body. — src/inject/jquery.min.3.1.js:1-2
The public name and description mention only general browser-enhancing tools. — manifest.json:3-6
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Defines globalEval, _evalUrl, script converters, and a script transport as standard library functionality. — src/inject/jquery.min.3.1.js:2
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Opens the fixed chrome://history and chrome://bookmarks pages without reading them. — src/bg/serviceworker.js:7-12
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no network or telemetry code. — src/bg/serviceworker.js:1-21
The UTM value is a fixed activation marker, with no reporting path. — src/inject/jquery.min.3.1.js:2
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests only tabs and windows permissions. — manifest.json:10-13
Does it record typing, form entries, clipboard contents, or screenshots?
It attempts to trigger and read a page-produced camera image, but actual capture is conditional and general keystroke or form logging was not found.
Clicks camera-related controls and reads picSave.src after timed delays. — src/inject/jquery.min.3.1.js:2
Can a website or remote server send commands that make the extension take actions?
A remotely chosen page URL containing the fixed marker can activate the packaged automation, but no remote party can supply arbitrary commands or receive the image through this version.
Uses the URL marker as the automatic activation condition. — manifest.json:26-35
Uses fixed selectors and sends only an internal message. — src/inject/jquery.min.3.1.js:2
Has no image handler or remote command channel. — src/bg/serviceworker.js:1-21
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Calls click on three matched elements and then calls close(). — src/inject/jquery.min.3.1.js:2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Only opens fixed local browser URLs. — src/bg/serviceworker.js:1-21
Custom prepended code uses DOM actions and internal messaging, not fetch or XMLHttpRequest. — src/inject/jquery.min.3.1.js:2
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:10-13
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The trigger, selectors, delays, image handling, and close action are fixed in the package. — src/inject/jquery.min.3.1.js:2
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Custom code reads fixed element IDs and sends one internal message; it does not accept page messages. — src/inject/jquery.min.3.1.js:2
Declares no externally_connectable interface. — manifest.json:1-37
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The hidden sequence is restricted by the exact URL marker, expected element IDs, and browser camera permission, but it has no disclosure or user control and its image sink is currently unhandled.
Restricts injection to the fixed UTM marker while applying it to every matching frame. — manifest.json:26-35
Skips missing elements but otherwise clicks automatically and provides no consent UI. — src/inject/jquery.min.3.1.js:2
Does not process the resulting image message. — src/bg/serviceworker.js:1-21
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Hidden work is a short timed DOM-and-image sequence rather than sustained computation. — src/inject/jquery.min.3.1.js:2
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Targets four fixed element IDs and does not inspect forms or input values. — src/inject/jquery.min.3.1.js:2