Is Screen Recorder for Tabs, Desktop, and Apps safe?
We analyzed Screen Recorder for Tabs, Desktop, and Apps version 1.10's actual code and gave it a 55/100 trust score. This is a legitimate screen recorder…
Bottom line
This is a legitimate screen recorder with unusually broad website access and a serious webpage-triggered webcam weakness.
What it can access
It can run on every website and capture screens, microphone audio, and camera video, which fits recording but is broader and more sensitive than necessary. [Q1][Q5]
Security weaknesses
A webpage can forge a message that activates the webcam component without confirming a recording is active or that the request is trusted. [Q21]
Signs of misuse
The package shows user-requested video conversion and no evidence of tracking or hidden collection, but the webcam trigger remains concerning. [Q6][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests every-site access, active-tab scripting, tab and desktop capture, unlimited storage, and code injection. Screen capture explains much of this, but always-on all-site injection and wildcard resource exposure are unnecessarily broad.
Declares storage, activeTab, tabCapture, unlimitedStorage, desktopCapture, scripting, and <all_urls> host access. — manifest.json:14-22
Automatically injects content-script.js and webcam.js into every URL and a file-upload helper into qooly.com's converter. — manifest.json:30-38
Makes every packaged resource web-accessible on every URL. — manifest.json:58-62
Which websites can it run on, and can it read or change what appears on those pages?
It adds recorder and webcam interfaces to pages and can temporarily scroll the document, change viewport behavior, and hide scrollbars while taking full-page screenshots.
Creates an open shadow-root recorder host, hidden audio-device iframe, image input, recording controls, and screenshot-related page changes. — content-script.js:3
Creates the in-page webcam component and its controls. — webcam.js:14261
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Captures MediaStreams and rendered screen pixels rather than extracting page DOM or input values. — recorder.js:14
Page access is used for recorder UI and screenshot positioning; no bulk DOM-content collection path was found. — content-script.js:3
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It queries and messages the active tab and opens recorder, welcome, editor, and converter tabs. No browsing-history database access or continuous URL collection was found.
Queries active tabs, injects the content script into existing web tabs on install, and opens extension-related pages. — background.js:1
Tracks the current captured tab and opens an editor or qooly converter tab as part of explicit recorder actions. — recorder.js:14
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can capture the screen, microphone, and webcam, accept a user-selected image, and keep large recordings in local IndexedDB. These are highly sensitive capabilities even though they match the product.
Uses tabCapture, desktopCapture, getUserMedia, MediaRecorder, and IndexedDB for recording. — recorder.js:14
Requests a video-only camera stream and assigns it to an in-page video element. — webcam.js:14261
Requests microphone access and enumerates audio devices in response to the extension's microphone workflow. — audio-devices.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A recording is provided to qooly.com only when the user chooses remote MP4 conversion. The webcam blur option can also download a BodyPix model from Google Storage.
The Convert action opens qooly.com/webm-to-mp4-converter and sends a blob URL to the converter tab after it loads. — recorder.js:14
Fetches the recording blob and places it in qooly.com's file input, dispatching input/change events. — content-upload.js:3
Optional background blur loads BodyPix model artifacts; no user recording is sent through that model loader. — webcam.js:14261
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads a fixed BodyPix model configuration only when background blur is enabled. — webcam.js:14261
The only fetch reads a packaged CSS file through chrome.runtime.getURL. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Content and webcam scripts run automatically on every page. Normal capture is user-started, but a webpage can forge a message that activates the enabled webcam component without a recording being active.
Injects content-script.js and webcam.js into all matching pages automatically. — manifest.json:30-34
The window message path activates the webcam based only on a spoofable source string and the stored webcam option. — webcam.js:14261
The legitimate runtime-message path checks tab identity, active recording state, and the webcam setting, showing the window-message path bypasses normal recording-state gating. — recorder.js:14
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting, proxy, search, or privacy-control permission. — manifest.json:14-22
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Large minified bundle contains identifiable Vue, TensorFlow.js, BodyPix, and compatibility code alongside a relatively small webcam application. — webcam.js:1-14261
Large worker bundle is identifiable media-processing code rather than an encrypted or unpacked-at-runtime payload. — worker/index.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Webpack global resolution uses globalThis first and only falls back to new Function('return this') if needed. — webcam.js:1
Regenerator fallback uses Function('r', ...) only when assigning through globalThis fails; its input is the bundled runtime object. — content-script.js:3
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses the active tab only as the current recording target. — recorder.js:14
Tab update and activation listeners do not store or transmit visited URLs. — background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Creates and stores a random user.id in extension state; no network sink for that identifier was found. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission. — manifest.json:14-22
No credential or form-value extraction path was found in the injected UI and screenshot code. — content-script.js:3
Does it record typing, form entries, clipboard contents, or screenshots?
It records screen pixels, camera video, and optional microphone audio. Those are advertised features, but the spoofable webpage message can activate the webcam component outside the normal recording workflow.
Creates MediaRecorder streams from tab/desktop video and optional microphone/system audio. — recorder.js:14
Requests camera video when the webcam component becomes active; the window-message activation lacks an active-recording check. — webcam.js:14261
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Handles a fixed set of internal recorder and screenshot messages; no socket, polling command endpoint, or externally connectable message handler was found. — background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Page changes implement recorder, screenshot, and selection controls rather than monetized or promotional content. — content-script.js:3
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or VPN-related permission. — manifest.json:14-22
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or filesystem-specific permission. — manifest.json:14-22
Uses browser IndexedDB and blob downloads for recorded media. — recorder.js:14
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads BodyPix with a fixed architecture for the optional blur effect. — webcam.js:14261
Its only fetch reads extension-packaged CSS via chrome.runtime.getURL. — background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
A webpage can cross into privileged extension behavior by forging a window.postMessage with source 'recorder-app' and data 'WEBCAM_SHOW'. That bypasses the normal active-recording check and can cause a camera request when the saved webcam setting is on.
Listens to every window message, checks only attacker-controlled data.source/data fields, and activates the webcam without validating event source, origin, or an unguessable token. — webcam.js:14261
The separate chrome.runtime need-webcam response correctly requires the sender tab, active recording status, and enabled webcam setting; the page-message path omits those checks. — recorder.js:14
The activated component requests getUserMedia video and is mounted in an open shadow root that the host page can inspect. — webcam.js:14261
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Activation is conditioned on the ordinary stored webcam option and renders the visible webcam component. — webcam.js:14261
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Loads webcam.js on every URL. — manifest.json:30-34
Records webcam.js at approximately 1.84 MB, the largest script in the package. — inventory.json:1
Loads BodyPix and repeatedly processes frames only when the blur setting is enabled. — webcam.js:14261
Does it change form fields or where a form sends its information?
It programmatically fills qooly.com's converter file input with the recorded video, but only after the user explicitly selects MP4 conversion. It does not alter arbitrary site forms or redirect form submissions.
The explicit Convert action opens the fixed qooly.com converter URL and sends the recording blob URL to that tab. — recorder.js:14
Constructs a File/DataTransfer, assigns it to the converter page's file input, and dispatches input/change events. — content-upload.js:3