Is Network Inspector safe?
We analyzed Network Inspector version 1.2's actual code and gave it a 62/100 trust score. Network Inspector broadly fits its purpose but has powerful…
Bottom line
Network Inspector broadly fits its purpose but has powerful all-sites visibility, sensitive URL retention, and a markup-injection weakness.
What it can access
It can monitor requests on every site and retain full URLs, which may expose sensitive query data; this fits network inspection but is broader than a narrow site tool needs. [Q1][Q2][Q3][Q12]
Security weaknesses
Unescaped visited-site URLs can inject markup into the extension view, and records persist locally without an overall expiry or clear-all control. [Q21][Q4]
Signs of misuse
No evidence shows data leaving the browser or remote code control; continuous URL recording is the stated inspection feature but can reveal browsing activity. [Q6][Q7][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has tabs, storage, webRequest, and all-sites access, allowing it to observe network metadata on any active tab.
Declares webRequest, tabs, storage, and <all_urls>. — manifest.json:9-10
Which websites can it run on, and can it read or change what appears on those pages?
It sees the active page URL and every requested resource URL, but does not read the page page or response body.
Reads the active tab URL and captures request URL, method, timestamp, and resource type from webRequest events. — background.js:5-16,37-55
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Full request URLs and response headers may contain sensitive identifiers or query data, although bodies and typed form values are not captured.
Stores unredacted request URLs and all available response-header names and values. — background.js:37-82
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It persistently stores captured request records in chrome.storage.local without an overall expiry or clear-all control.
Writes the requests object to local storage, reloads it on activation, and clears only the active tab's records during navigation or reload. — background.js:71-78,101-146
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It creates a local CSV download containing the displayed request metadata after the user clicks Export CSV.
Builds a CSV Blob from the table and downloads requests.csv. — popup.js:10-12,158-181
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Only observes traffic and writes records to local extension storage. — background.js:1-158
Reads local records, renders them, and creates a local CSV; it makes no data-upload request. — popup.js:1-231
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All capture logic and filters are packaged locally. — background.js:1-158
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Monitoring and local recording occur automatically for the active tab without requiring the popup to be opened.
Tab and webRequest listeners update active-tab state and record traffic whenever matching events occur. — background.js:5-82
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting permissions. — manifest.json:9-10
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains straightforward event listeners and storage logic. — background.js:1-158
Contains straightforward filtering, rendering, and CSV logic. — popup.js:1-231
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Builds an anchor with unescaped req.url through innerHTML. — popup.js:183-208
Restricts extension scripts to packaged self resources. — manifest.json:22-24
Does it track the websites, pages, searches, or links you visit?
It continuously records full request URLs for the active tab, which can reveal visited pages and sensitive query parameters.
Stores both the active page URL and each request URL without redaction. — background.js:5-16,37-55,125-146
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Captured data remains in local extension storage. — background.js:1-158
Does it send cookies, session details, authentication data, or page contents elsewhere?
It does not read cookies or authorization request headers, but full URLs and response headers may incidentally expose session-like tokens placed there by a website.
Captures URL and responseHeaders only; no requestHeaders, requestBody, or cookies permission is used. — background.js:37-82
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares network, tabs, and storage access but no page-content or capture mechanism. — manifest.json:9-10
Processes webRequest metadata only. — background.js:37-82
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The only message action returns stored records to the extension popup. — background.js:85-99
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, scripting permission, or web-accessible injected resource. — manifest.json:1-30
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It observes request and response metadata across all sites but does not block, redirect, proxy, or modify traffic.
Uses passive onBeforeRequest and onCompleted listeners to record metadata. — background.js:37-82
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or system-level permission. — manifest.json:9-10
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains no fetch, XMLHttpRequest, import, or remote configuration logic. — background.js:1-158
Processes stored records locally. — popup.js:1-231
Can ordinary websites access privileged extension features through messaging or exposed files?
A request URL controlled by a visited site is inserted into popup innerHTML without escaping, allowing extension-UI markup injection; script execution was not demonstrated because of CSP.
Interpolates req.url directly into an anchor string assigned to innerHTML. — popup.js:183-208
The extension-page CSP permits scripts only from self. — manifest.json:22-24
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Listeners begin recording active-tab traffic as the service worker runs. — background.js:5-82
Opening the popup loads records and clicking Export creates the CSV. — popup.js:1-12,41-51,158-181
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Work is limited to handling tab and network events and persisting records. — background.js:1-158
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no page-injection mechanism. — manifest.json:1-30
Collects network metadata only, without request bodies. — background.js:37-82