Is SendMe Telegram safe?
We analyzed SendMe Telegram version 0.3.2's actual code and gave it a 76/100 trust score. This is a mostly purpose-aligned sharing extension with broad…
Bottom line
This is a mostly purpose-aligned sharing extension with broad page reach and limited tracking concerns.
What it can access
It runs on every ordinary website and can send selected text, links, coordinates, and images for Telegram sharing.[Q1][Q3][Q5][Q6]
Security weaknesses
No meaningful weakness was found: websites cannot access privileged features, remote replies do not issue commands, and no downloaded code executes.[Q7][Q16][Q21]
Signs of misuse
Sharing is tied to user actions, but the developer’s service receives shared content and Google Analytics receives a popup event.[Q6][Q8][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs a page access on every HTTP and HTTPS page and can read active or newly created tab URLs for its sharing features.
Declares all-page content scripts plus tabs, activeTab, contextMenus, and storage. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Only reads prefers-color-scheme and sends the resulting light or dark setting to the background. — sendme.js:1-17,82-84
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It receives selected text, page URLs, link URLs, image URLs, and map coordinates when the user invokes a matching sharing action.
Context-menu and getNaviLink handlers build messages from the user-selected content and pass them to the SendMe bot path. — background.js:225-249,389-394
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores a persistent routing key, Telegram activation state, color scheme, and small UI counters locally.
Creates and stores random_key and reads local telegram_user_id before sending. — background.js:24-51,67-85,147-178
Reads setup state and counters from chrome.storage.local. — popup.js:56-71,144-171
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It downloads an image chosen through the context menu and uploads the resulting bytes to the SendMe proxy.
Fetches info.srcUrl as a blob and posts it as multipart photo data after the user chooses Send image to Telegram. — background.js:174-223,235-238
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Shared text, URLs, coordinates, and images are sent to the developer's proxy, which can see the content before forwarding it to Telegram.
Posts message text or image bytes with chat_id and random key to https://sendme.duckdns.org/messageproxy.php. — background.js:147-223,225-249,389-394
Sends a fixed popup-open event to Google Analytics using constant client ID 555. — popup.js:14-40
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses a fixed proxy endpoint; responses are limited to activation status rather than executable settings. — background.js:8-14,103-223
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It observes each newly created tab URL for a Google Play match, but does not upload it; shared content is otherwise sent only after user actions.
The tabs.onCreated listener checks tab.url locally and sends matching Play Store URLs only to the extension content script. — background.js:355-373
The receiver for the Play Store message is commented out. — sendme.js:20-34
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting or proxy permission. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive functions and fixed endpoints without concealment. — background.js:1-440
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Legacy jQuery 2.1.4 includes globalEval as library functionality. — js/jquery2.min.js:2
Extension-page CSP allows only self-hosted scripts. — manifest.json:3
Does not call eval, globalEval, getScript, or any text-to-code path. — background.js:1-440
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses toolbar/context actions to send chosen URLs and separately checks new tab URLs locally for Google Play. — background.js:225-249,268-281,355-373
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a stable local routing key tied to Telegram delivery; Google Analytics receives a popup-open event with a constant, non-unique client ID.
Persists random_key and includes it with activation and delivery requests. — background.js:24-34,67-75,147-190
Posts Popup Opened with cid=555 to Google Analytics. — popup.js:14-40
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Sends the user-entered activation PIN and routing key to the fixed SendMe proxy; no browser credential API is used. — background.js:103-145
Declares no cookies or password-related permission. — manifest.json:3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Contains no key, input, form, or capture listener. — sendme.js:1-84
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Proxy responses only determine local activation status; privileged commands originate from packaged extension pages or its own content script. — background.js:87-145,375-409
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The only formerly planned page notification code is commented out; active code does not edit the DOM. — sendme.js:1-84
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It fetches a user-selected image URL and makes delivery, activation, and analytics requests, but does not intercept or proxy general browser traffic.
Fetches the SendMe proxy and selected image URL for the bot workflow. — background.js:103-223
Posts a fixed event to Google Analytics when the setup popup opens. — popup.js:14-40
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Consumes activation text responses and sends or receives image/message data without executing the response as code. — background.js:87-223
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes no window-message, custom-event, or DOM-command bridge. — sendme.js:1-84
Declares no externally_connectable websites. — manifest.json:3
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Enables sharing after activation and attaches send functions to explicit toolbar and context-menu actions. — background.js:24-51,225-249,299-337
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains Telegram delivery, setup, context-menu, and small UI logic only. — background.js:1-440
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Active content-script logic does not inspect or modify forms or inputs. — sendme.js:1-84