Is Chrome Capture - Screenshot & GIF safe?
We analyzed Chrome Capture - Screenshot & GIF version 3.3.8's actual code and gave it a 68/100 trust score. This is a legitimate capture tool with broad…
Bottom line
This is a legitimate capture tool with broad optional access and automatic tracking that reduce confidence, but the package shows no remote code execution or clear hostile control.
What it can access
It can capture selected pages, screens, windows, and audio, and can edit pages during capture; optional all-site access broadens reach. [Q1][Q2][Q5][Q14]
Security weaknesses
No concrete privilege bypass or website-controlled action was found, although large bundled components make independent review harder. [Q10][Q16][Q21]
Signs of misuse
It automatically sends usage data and session-replay information, and keeps recognition identifiers, beyond the core capture action. [Q6][Q8][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests active-tab scripting, tab capture, desktop capture, identity, offscreen processing and storage, with optional tabs/downloads/notifications and all-site access. These are broad but mostly necessary or optional for the advertised capture and export features.
Declares activeTab, tabCapture, desktopCapture, identity, scripting and offscreen, plus optional tabs, notifications, downloads and *://*/* origins. — manifest.json:1-2
Requests tabs/all-origin access only when the user enables cross-URL overlay behavior. — dist/options/bundle.js:100
Which websites can it run on, and can it read or change what appears on those pages?
On a capture command it injects packaged selection/full-page tools into the active site, reads layout dimensions, scrolls the page and temporarily changes styles. It has no always-on page access and does not continually read pages.
Uses chrome.scripting.executeScript only for requested full-page, cropping and overlay tools. — dist/background/bundle.js:1
Measures the document, enumerates elements, scrolls through the page, adjusts styles and restores the original state after capture. — dist/fullwebpage/bundle.js:1
Defines no persistent content_scripts entry. — manifest.json:1-2
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
A user-started screenshot or recording can visually capture passwords, payment details, messages or form values that are visible on the chosen page/screen. The code does not separately query or monitor input values or typing.
captureVisibleTab records the rendered active tab; full-page capture repeatedly captures visible slices. — dist/background/bundle.js:1
MediaRecorder records the selected tab/desktop stream until the user stops it. — dist/offscreen/bundle.js:1
No input-value extraction or keyboard listener was identified; sensitive content is exposed only as rendered pixels. — dist/fullwebpage/bundle.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Contains no cookies, history or bookmarks permission; tabs and downloads are optional. — manifest.json:1-2
Queries the active tab and optionally uses its hostname/title to build a capture filename. — dist/background/bundle.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can capture a selected tab, screen or application window and its tab/system audio, write captures to disk, copy images/links to the clipboard and upload selected output to Drive. It does not access the camera, microphone, location or native applications.
Uses display/tab media streams with video and tab/desktop audio and records them with MediaRecorder. — dist/offscreen/bundle.js:1
Uses desktopCapture/tabCapture, captureVisibleTab and optional downloads for user-started captures. — dist/background/bundle.js:1
Can copy a selected image/link and explicitly upload an edited file to Google Drive. — dist/editor/bundle.js:151
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends usage/error/purchase telemetry to Google Analytics, options/editor session-replay data to Microsoft Clarity, identity/subscription data to Firebase/developer Cloud Functions/Paddle, and an edited capture to Google Drive only when the user chooses Drive upload.
Posts analytics events containing client/session IDs, event parameters, release and optional subscription tier to Google Analytics. — dist/background/bundle.js:1
Starts Clarity project 45pdo7gsbp with content tracking and upload to s.clarity.ms/collect. — libs/microsoft/clarity2.js:1-26
Performs explicit resumable Google Drive uploads and sends auth/subscription requests to remote services. — dist/editor/bundle.js:151
Does it download or run code, settings, or instructions supplied by a remote server?
Remote services return subscription state, pricing, checkout results and Google Drive metadata that control feature availability and export UI. They do not supply code or hidden capture instructions to a privileged extension context.
Cloud Functions return purchase/subscription status and plan-update results used by the settings UI. — dist/options/bundle.js:100
Google Drive responses supply file IDs and links; Paddle responses drive checkout state. — dist/editor/bundle.js:151
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Capture itself requires a user command, but Analytics and Clarity telemetry run automatically when relevant extension pages/features are used, without a separate per-event prompt.
Reports install/update and command events automatically with a generated client ID. — dist/background/bundle.js:1
Loads the Clarity bootstrap whenever the local editor opens. — layout/editor.html:1-28
Loads the Clarity bootstrap whenever options opens. — layout/options.html:1-26
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings override, search provider, chrome_url_overrides, proxy, privacy, management or debugger permission. — manifest.json:1-2
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most logic is bundled/minified, including a very large editor and packaged Fabric, Paddle, Clarity, React and media-codec dependencies. Some capture modules remain readable, but the dependency volume makes review materially harder.
Records roughly 13 MB unpacked, including a 5.3 MB editor and multiple large minified third-party bundles. — inventory.json:1-381
Combines UI, authentication, billing, analytics, Drive and editing code in a minified webpack bundle. — dist/editor/bundle.js:1-151
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Webpack checks globalThis first, then contains the fixed new Function('return this') fallback. — dist/background/bundle.js:1
Contains the same fixed webpack global fallback in the packaged checkout library. — libs/paddle/paddle.js:1
Extension-page CSP allows wasm-unsafe-eval but not unsafe-eval. — manifest.json:1-2
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Active-tab metadata is used for filenames; onUpdated/onActivated listeners are installed only for an active fullscreen overlay and removed when capture stops. — dist/background/bundle.js:1
History is absent and tabs is optional. — manifest.json:1-2
Does it create a persistent ID or browser fingerprint to recognize you?
It generates and stores a persistent random Google Analytics client ID and attaches a 30-minute session ID, release and optional subscription tier to telemetry. Clarity maintains its own analytics/session identifiers.
getOrCreateClientId stores crypto.randomUUID() in chrome.storage.local; fireEvent sends it as client_id. — dist/background/bundle.js:1
Starts a Clarity session with a 365-day configuration and remote collection endpoint. — libs/microsoft/clarity2.js:1-26
Does it send cookies, session details, authentication data, or page contents elsewhere?
An explicitly selected capture is uploaded to Google Drive, and Google/Firebase identity tokens are sent for sign-in/subscription checks. Clarity receives extension-page UI/session data, but captured image/video/canvas elements are explicitly masked; no raw media upload to the developer was found.
Uses Google OAuth to upload the selected blob to Drive and optionally grant anyone-reader permission. — dist/editor/bundle.js:151
Sends Firebase ID tokens to developer Cloud Functions for purchase/subscription operations. — dist/options/bundle.js:100
Marks displayed img, video, canvas and frame thumbnails with data-clarity-mask=True. — dist/editor/bundle.js:151
Does it record typing, form entries, clipboard contents, or screenshots?
It captures screenshots, selected screens/windows, tabs and tab/system audio on command, and can write chosen images or links to the clipboard. It does not continuously watch typing, forms or clipboard contents and does not request microphone/camera capture.
Acquires user-selected desktop/tab streams with video and tab/desktop audio and records them locally. — dist/offscreen/bundle.js:1
Copies a user-selected canvas image through navigator.clipboard.write. — dist/popup/bundle.js:100
No audioCapture, videoCapture or clipboardRead permission is declared. — manifest.json:1-2
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Capture dispatcher is reached through extension commands/runtime messages; there is no onMessageExternal listener or webpage bridge. — dist/background/bundle.js:1
Contains no externally_connectable declaration. — manifest.json:1-2
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Page changes support capture layout/scrolling and are restored; no commerce or link-rewriting path was found. — dist/fullwebpage/bundle.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
With optional downloads permission it creates and reveals capture files in the browser's download manager. It does not intercept traffic, proxy requests, rewrite headers or redirect browser networking.
Uses chrome.downloads.download/show only for generated capture files. — dist/background/bundle.js:1
No proxy, webRequest, declarativeNetRequest or debugger permission is declared. — manifest.json:1-2
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No localhost/private-address host permission or nativeMessaging permission is declared. — manifest.json:1-2
Reviewed network destinations are Google, Microsoft Clarity, Paddle and the developer's public Cloud Functions. — inventory.json:1-381
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Dynamic chunks and encoder WASM are packaged local resources used for GIF/media conversion. — dist/encoder.bundle.js:1
CSP limits extension scripts to self and wasm-unsafe-eval; reviewed remote responses do not reach script sinks. — manifest.json:1-2
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes only images/* and _locales/* and declares no externally_connectable entry. — manifest.json:1-2
Registers internal runtime messaging but no onMessageExternal handler. — dist/background/bundle.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches on capture command, browser, settings and purchase status; no covert victim/domain targeting gate was identified. — dist/background/bundle.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Records selected media at up to high resolutions and bitrates under user settings. — dist/offscreen/bundle.js:1
Uses workers/WASM for frame extraction, GIF encoding and media editing after a user capture. — dist/editor/bundle.js:1-151
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Capture logic records/restores page styles and scroll position; no form action/value rewrite was found. — dist/fullwebpage/bundle.js:1
Selection overlay handles pointer/crop UI rather than host-page form submission. — dist/croppingtool/bundle.js:1