Is fonts infos safe?
We analyzed fonts infos version 5.0.1's actual code and gave it a 82/100 trust score. This appears to be a legitimate font-inspection extension with broad…
Bottom line
This appears to be a legitimate font-inspection extension with broad page access but no evidence of data misuse or dangerous remote control.
What it can access
It can inspect visible content and styles across all HTTP and HTTPS pages, which fits font inspection but gives it broad reach. [Q1]
Security weaknesses
Inspections and page changes require a user command, and no website-to-extension privileged control is shown. [Q8][Q16]
Signs of misuse
The package shows no evidence of sending page data elsewhere or collecting cookies, sessions, or authentication details. [Q6][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
Its page access can run on every HTTP and HTTPS page, although its only named permissions are storage and context menus.
Loads the inspector scripts on all HTTP and HTTPS pages. — manifest.json:13-25
Requests only storage and contextMenus as named permissions. — manifest.json:40-43
Which websites can it run on, and can it read or change what appears on those pages?
After a user command, it traverses page elements, checks their direct text and reads computed font styles.
Walks body descendants, reads direct text and collects font weight, size, style, color, line height, decoration, transform, family and spacing. — fontAll.js:138-158
Starts inspection only when the background sends a font or fontAll command. — foreground.js:3-16
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The text value is used only for the haveText test; the generated output contains computed font properties rather than the text. — fontAll.js:138-158
The single-property mode likewise checks text presence and appends only the selected CSS property. — font.js:62-106
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores only user preferences such as context-menu availability and color-display mode; it does not request browser history or browsing-data access.
Saves contextual and hex_rgb preferences to chrome.storage.sync. — options/options.js:11-18
Requests storage and contextMenus, not history or browsingData. — manifest.json:40-43
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
The permission list contains only storage and contextMenus. — manifest.json:40-43
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Declares no remotely contacted application host; update_url is Chrome's standard package updater. — manifest.json:1-45
Runtime messages only initialize local context menus. — background.js:56-65
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Behavioral settings come from user-controlled Chrome sync preferences. — options/options.js:11-43
The font commands and allowed properties are defined locally in the package. — background.js:67-160
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Listener code loads automatically on ordinary webpages, but page traversal and modification require a user-selected popup or context-menu command.
Injects the listener scripts on matching pages. — manifest.json:13-25
Performs inspection only for a received font or fontAll command. — foreground.js:3-16
Popup clicks send the inspection and removal commands. — popup/popup.js:6-45
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, browserSettings, privacy, search or management permission. — manifest.json:40-43
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable named functions implement each extension action. — background.js:67-160
Contains a standard identified jQuery 3.6.3 slim build. — jquery-3.6.3.min.js:2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The library defines globalEval using a temporary script element; the package contains no caller outside this library. — jquery-3.6.3.min.js:2
The active command dispatcher calls only local font display and cleanup functions. — foreground.js:3-16
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Content scripts are eligible on all HTTP and HTTPS pages. — manifest.json:13-25
Requests neither history nor tabs permission. — manifest.json:40-43
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Startup stores display defaults and loads local preferences; it does not create an identifier. — background.js:1-17
No analytics or remote host is declared. — manifest.json:1-45
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
The permission list does not include cookies. — manifest.json:40-43
The inspection loop reads text presence and computed style properties, not cookies or storage tokens. — fontAll.js:138-158
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The only installed page handlers are mouseover, click and mouseout handlers for showing font details. — fontAll.js:138-179
Requests no clipboard or capture permission. — manifest.json:40-43
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Local context-menu handlers send the fixed font, fontAll and removeFont commands. — background.js:84-157
Declares no externally_connectable entry. — manifest.json:1-45
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Appends movable and static font-information overlays to the page body. — fontAll.js:33-47
Changes styles and attaches mouse/click handlers, including preventDefault while the inspector is active. — fontAll.js:159-178
Removes overlays and restores saved style values when disabled. — removeFont.js:12-24
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads or proxy permission. — manifest.json:40-43
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests neither nativeMessaging nor any device/system permission. — manifest.json:40-43
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Defines the allowed properties and command behavior in packaged code. — background.js:67-160
Loads only packaged JavaScript files as content scripts. — manifest.json:13-25
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Listens only on chrome.runtime.onMessage and accepts the extension's fixed local commands. — foreground.js:3-18
Declares no externally_connectable access. — manifest.json:1-45
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Saves and restores context-menu and color-display preferences. — options/options.js:11-43
User checkbox changes update locally stored inspection options. — popup/popup.js:54-78
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Its main loop performs a finite DOM/style inspection after user activation. — fontAll.js:138-180
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The page modification path changes presentation styles and adds font overlays; it does not set form or input properties. — fontAll.js:138-179
The single-property mode reads computed CSS and appends a display overlay only. — font.js:62-106