Is Email Finder by Snov.io safe?
We analyzed Email Finder by Snov.io version 2.3.26's actual code and gave it a 72/100 trust score. This is a purpose-aligned lead-finding extension with…
Bottom line
This is a purpose-aligned lead-finding extension with broad page and cookie access, limited evidence of misuse, and some privacy and design concerns.
What it can access
It can read complete page markup on any website, access selected service cookies, and send page or domain information for lead searches, which broadly fits its purpose but exposes sensitive data risks.[Q1][Q2][Q4][Q15]
Security weaknesses
The design gives the extension broad page-reading power and can copy sensitive information present in page markup, while a trusted vendor page can trigger limited extension state changes.[Q2][Q3][Q21]
Signs of misuse
The package sends lookup data and persistent analytics information to its services and may open a promotional page automatically, but the evidence does not show credential theft or remote control.[Q6][Q8][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, cookies, notifications, storage, all HTTP/HTTPS hosts, and a page access on every URL. This is broad but materially connected to its advertised cross-site lead-finding feature.
Declares an all-URLs content script, tabs, cookies, notifications, storage and HTTP/HTTPS host permissions. — manifest.json:9-54
The popup queries the active tab, requests its HTML and performs URL/domain contact lookups. — js/popup.js:1
Which websites can it run on, and can it read or change what appears on those pages?
The page access can return the active page's entire serialized HTML. The reachable request comes from the popup after the user clicks the extension button; no timer or navigation listener requests HTML while the popup is closed.
Responds to the internal getInnerHTML message with document.all[0].innerHTML. — js/content.js:1
initPopupTabsQuery sends getInnerHTML only to the current active tab during popup initialization. — js/popup.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Because it copies complete HTML, it can locally receive sensitive text or attributes present in the page markup. It does not monitor keystrokes, and dynamic input values are not necessarily reflected in innerHTML.
The source is the whole document HTML rather than a narrow email selector. — js/content.js:1
searchEmailsO applies an email-address regular expression and filters results locally. — js/common/common.js:38-42
Locally extracted emails are merged into popup results; the whole HTML response is not passed to an API helper. — js/popup.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It has cookie access and reads Snov.io selector/token cookies for account authentication plus Twitter's ct0 CSRF cookie for Twitter profile queries. Those values are sent only to the same services that issued them.
Reads selector and token only for https://app.snov.io and POSTs them to that host's /api/checkAuth. — js/CheckAuth.js:1
Reads only Twitter's ct0 cookie in the Twitter popup path. — js/twitter/twitter.js:1
history, bookmarks and downloads permissions are absent. — manifest.json:45-50
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No geolocation, media, file-system, clipboardRead or nativeMessaging permission is declared. — manifest.json:45-54
copyEmailValue creates a temporary input and calls document.execCommand('copy') only from the copy click handler. — js/twitter/twitter.js:6
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Opening the popup automatically sends the active page's full URL to Snov.io's contacts lookup and its origin to the company lookup. If fewer than ten results are available, the domain is placed in a Bing search query over HTTP.
Calls apiGetEmailsByDomain({link: activeTabUrl}), apiGetCompanyInfo({url: origin}) and, when needed, http://www.bing.com/search?q='*%40'+domain. — js/popup.js:1
Fixed Snov.io endpoints accept contact/company/list data used by visible search and save flows. — js/apiMethods.js:1
POSTs tracking ID, persistent gaCID, event category and action to Google Analytics with no referrer and no page URL field. — js/background/googleAnalyticsEvents.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
Snov.io supplies contact results, account state, news metadata and links. News can provide a URL that opens only after the user clicks the news indicator.
Stores newsObj from the fixed Snov.io API and opens newsObj.url only from showLastNews. — js/background/newsChecker.js:1
showLastNews is invoked only for the matching internal popup message. — js/sw.js:1
Remote API responses are parsed as JSON contact, list, balance and news data. — js/apiMethods.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Installation opens a Snov.io registration page and emits an analytics event. During a fixed annual Black Friday date window, startup or install can automatically open a Snov.io promotional tab after 15 seconds, once per year.
onInstalled opens the registration URL and schedules the Black Friday check; onStartup also schedules it. — js/sw.js:1
Limits automatic promotion to Nov 24–Dec 3 and records a yearly completion key before opening the fixed localized Snov.io URL. — js/background/blackFridayPromotion.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser override, proxy, privacy or settings permission is declared. — manifest.json:1-58
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Snov.io endpoints and request shapes are readable in the compacted source. — js/apiMethods.js:1
Identifiable packaged jQuery library. — js/libs/jquery.min.js:1-2
Readable public-suffix/domain parsing library and data. — js/libs/tld.js:1-6846
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Packaged library contains standard script/evaluation support. — js/libs/jquery.min.js:1-2
Page HTML is returned as data to popup parsers, not an evaluator. — js/content.js:1
Remote responses are consumed through response.json(). — js/apiMethods.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Popup initialization reads activeTab.url and passes it as link to apiGetEmailsByDomain. — js/popup.js:1
Serializes link into the Snov.io contacts/get-by-domain query. — js/apiMethods.js:1
No navigation or background transmission listener exists in the always-present content script. — js/content.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates and stores a persistent random gaCID and attaches it to every Google Analytics event. Local storage also retains the Snov.io username, prior list choices and UI state.
Loads or generates gaCID with crypto.getRandomValues, saves it in chrome.storage.local and sends it as Google's cid. — js/background/googleAnalyticsEvents.js:1
Uses localStorage for account display name, balance, selected list IDs and UI preferences. — js/common/common.js:1-42
Does it send cookies, session details, authentication data, or page contents elsewhere?
The Snov.io selector/token cookies are POSTed to Snov.io's own /services/checkAuth services, and Twitter's ct0 cookie is sent as x-csrf-token only to Twitter's services. These are normal authentication requests to the intended services, not demonstrated credential theft.
Reads only app.snov.io selector/token cookies and sends them to https://app.snov.io/api/checkAuth with credentials. — js/CheckAuth.js:1
Sets the Twitter ct0 value as x-csrf-token on a fixed https://api.twitter.com GraphQL request. — js/twitter/twitterParserApi.js:1
Page HTML feeds local parsers; outbound lookup receives the URL/domain rather than e.data. — js/popup.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
Opening the popup captures a snapshot of the active page's complete HTML for local parsing. It does not register key, input, submit, clipboard-read or screenshot listeners.
Returns one HTML snapshot only in response to getInnerHTML. — js/content.js:1
Processes the snapshot for emails and company data when the popup opens. — js/popup.js:1
Clipboard write occurs only from the visible copyEmailValue click handler. — js/twitter/twitter.js:6
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote newsObj is stored and its URL is opened only by showLastNews. — js/background/newsChecker.js:1
Runtime message handling is a fixed allowlist of internal boolean/type cases. — js/sw.js:1
No externally_connectable declaration exists. — manifest.json:1-58
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Install and promotional flows open fixed Snov.io destinations. — js/sw.js:1
Visible popup buttons link to account, help, history and pricing pages. — js/common/common.js:1-42
The general content script only responds with HTML and does not modify page links. — js/content.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is declared. — manifest.json:45-54
Request headers are set only on the extension's direct fixed Twitter API call. — js/twitter/twitterParserApi.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
nativeMessaging is absent; source endpoints are public Snov.io, Twitter, Bing and Google Analytics services. — manifest.json:45-54
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
HTML snapshot is returned to fixed parser functions. — js/content.js:1
Server responses use JSON parsing and fixed data consumers. — js/apiMethods.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
On the allowlisted https://app.snov.io site, a page access listens for the onUserListsChanged page event and tells the worker to refresh list state; another adds a hidden finder_new marker. Any script on that trusted vendor origin can trigger the refresh flag, but it cannot supply a command or reach broader privileged operations.
snovioEvents.js and presence.js are limited to https://app.snov.io/*. — manifest.json:17-34
onUserListsChanged sends only needUpdateUserLists:true. — js/snovio/snovioEvents.js:1
That message only writes a boolean storage flag. — js/sw.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines the annual date range, fixed localized URLs and per-year completion storage key. — js/background/blackFridayPromotion.js:1
Current hostname selects visible Google, Twitter, Yelp or general website parsing flows. — js/popup.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contact polling is capped at ten attempts with five-second delays after saving a prospect. — js/twitter/twitter.js:1-6
Background work is limited to news, version, promotion and analytics handling. — js/sw.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Only listens for getInnerHTML and returns data; it performs no DOM assignment. — js/content.js:1
On app.snov.io only, adds a hidden marker div and does not touch forms. — js/snovio/presence.js:1