Is Screen Recorder & Screenshot App for Chrome | Scrnli safe?
We analyzed Screen Recorder & Screenshot App for Chrome | Scrnli version 4.3.9's actual code and gave it a 58/100 trust score. This is a useful recorder…
Bottom line
This is a useful recorder with unusually broad access and a serious webpage-to-camera control weakness.
What it can access
It can read and capture pages on every website and use screen, tab, camera, and microphone access for recording, which fits its purpose but exposes sensitive content.[Q1][Q3][Q5][Q6]
Security weaknesses
Any webpage can send a forged message that activates the webcam feature without verifying the sender, allowing unwanted camera prompts or activation.[Q16][Q21]
Signs of misuse
Sharing and conversion are user-triggered, with no evidence of browser-data theft or covert tracking, though sharing sends a persistent fingerprint to Scrnli.[Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has all-site access plus tab, desktop and debugger-based capture powers. These are broad but consistent with its advertised screenshot and recording features.
Requests tabCapture, desktopCapture, scripting, debugger and access to every HTTP(S) page. — manifest.json:14-25
Declares visible commands for screenshots, full-page downloads and adding images. — manifest.json:81-99
Which websites can it run on, and can it read or change what appears on those pages?
It can inspect page dimensions, scroll pages and capture their visible contents for screenshots. No general text scraping was found.
Loads capture and recorder content scripts on all pages. — manifest.json:34-68
Measures the page, scrolls through it and requests visible-tab images for full-page capture. — js/content-script.js:13
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
User-requested screenshots and recordings can visually include sensitive messages or filled forms, but the code does not target or extract those fields separately.
Captures the visible tab or full rendered page into image data. — js/background.js:13
Captures a tab or selected screen region into a MediaRecorder stream after the recording workflow starts. — js/recorder.js:20
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The permission list contains capture and page-access capabilities but no cookies, history, bookmarks or downloads permission. — manifest.json:14-25
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can use the camera, microphone, tab audio, desktop display and local downloads as part of explicit recording and saving features.
Uses getUserMedia, tabCapture, desktopCapture and MediaRecorder for the selected recording mode. — js/recorder.js:20
Converts image data to a Blob and starts a local download when asked by the background workflow. — js/offscreen.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends a chosen screenshot to Scrnli's storage service for sharing and hands a chosen recording to Scrnli's converter. Both are user-initiated product features.
The Share action POSTs the edited image and generated identifiers to https://storage.scrnli.com/api/v1/files/. — js/modal.js:20
The Convert action opens Scrnli's converter and sends it the locally recorded WebM blob. — js/recorder.js:20
Places that blob into the converter page's file input so the site can process it. — js/content-upload.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The optional webcam-blur feature downloads fixed BodyPix model files. They are model data for a disclosed visual effect, not general behavioral commands or JavaScript.
Loads the BodyPix model only when the saved blur option is enabled. — js/webcam.js:17033
TensorFlow's packaged loader fetches the fixed model JSON and associated weights. — js/webcam.js:3983
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically injects packaged capture controls on pages and creates a local user ID, but it does not automatically begin screenshots or screen recording.
Packaged content scripts load automatically on all pages. — manifest.json:34-68
Creates a local random user ID when none exists; capture actions remain tied to commands or runtime messages. — js/background.js:13
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-settings or management permission is present. — manifest.json:14-25
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most application code is minified together with large third-party libraries, which makes review harder. No encrypted data, packer or deliberate concealment layer was found.
The service worker is a minified Webpack bundle containing application and library code. — js/background.js:1-13
The webcam bundle includes minified Vue, TensorFlow and application logic. — js/webcam.js:1-17033
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Fabric 2.4.6 can compile serialized clipTo or pattern functions, but this editor loads only its own in-memory undo/redo state into Fabric. — assets/f.js:1
The other new Function uses are standard global-object and setImmediate compatibility helpers with locally supplied callbacks. — js/background.js:13
The worker's new Function returns the global object and does not consume fetched text. — worker/index.js:11516
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Tab update and activation listeners only refresh the extension icon. — js/background.js:13
The all-sites script implements capture UI and page measurements without collecting the page URL. — js/content-script.js:13
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent local ID and computes a browser fingerprint. The fingerprint is sent as a request header to Scrnli's storage services during user-initiated sharing.
Generates and stores a random user.id when the extension first runs. — js/background.js:13
FingerprintJS derives visitorId and the upload client places it in the x-csrf-token header. — js/modal.js:20
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission is requested. — manifest.json:14-25
The upload client uses withCredentials only for the intended storage.scrnli.com destination. — js/modal.js:20
Does it record typing, form entries, clipboard contents, or screenshots?
It records screenshots, screens, tabs, microphone audio and camera video. Except for the separate webcam bridge flaw, these operations follow visible user capture choices.
Captures visible tabs and full pages into image data. — js/background.js:13
Creates microphone, camera, tab and desktop streams and records them with MediaRecorder. — js/recorder.js:20
The injected webcam component calls getUserMedia when activated. — js/webcam.js:17033
Can a website or remote server send commands that make the extension take actions?
A visited webpage can issue one narrow unauthenticated command: show or hide Scrnli's webcam overlay. It cannot use this bridge to upload captures or invoke arbitrary extension actions.
The window message listener trusts data.source='scrnli' and WEBCAM_SHOW/WEBCAM_HIDE without verifying event.source, origin or a nonce. — js/webcam.js:17033
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds shadow-DOM capture controls and temporary scrollbar/page styles. — js/content-script.js:13
Displays packaged recorder controls only when recording state messages activate them. — js/video-recorder-content.js:5952-5965
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It can download finished captures and upload a capture for sharing or conversion. No proxying or hidden background transfer was found.
Creates a temporary anchor and downloads user-selected image data. — js/offscreen.js:1
Uploads an edited screenshot only from the Share workflow. — js/modal.js:20
Sends a recording to the converter only after the Convert action. — js/recorder.js:20
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is requested. — manifest.json:14-25
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Dynamic content injection names packaged extension scripts rather than remote URLs. — js/background.js:13
Remote model loading is reached only through the local blur feature and feeds TensorFlow inference, not a code execution sink. — js/webcam.js:17033
Can ordinary websites access privileged extension features through messaging or exposed files?
The all-sites webcam page access exposes an unrestricted page-message bridge that can reach camera activation. The caller needs only to forge a simple marker object.
Accepts window messages containing source='scrnli' and data='WEBCAM_SHOW', then mounts a component whose start method calls getUserMedia. — js/webcam.js:17033
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Checks storage.record.webcam before setting active, then displays the webcam component and requests video-only media. — js/webcam.js:17033
Normal recorder-driven webcam activation is additionally tied to active recording and the targeted tab; the page bridge omits that check. — js/recorder.js:20
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Heavy computation belongs to packaged TensorFlow BodyPix processing for the optional webcam blur effect. — js/webcam.js:2401-17033
The worker implements local media conversion rather than mining protocols. — worker/index.js:1-11519
Does it change form fields or where a form sends its information?
On Scrnli's own converter page, it places the user-selected recording into a file input to begin conversion. It does not alter form destinations or collect typed form values.
Restricts the conversion helper content script to Scrnli's converter URL. — manifest.json:44-50
Builds a File from the local recording blob, assigns it to the converter's file input and dispatches input/change events. — js/content-upload.js:1