Is Citation Hero - Free Citation Generator safe?
We analyzed Citation Hero - Free Citation Generator version 1.0.2's actual code and gave it a 65/100 trust score. Useful access is limited, but sending…
Bottom line
Useful access is limited, but sending complete page addresses to a remote service creates meaningful privacy and security concerns.
What it can access
It requests only tabs access and sends the active tab’s full URL to its citation service, which fits the feature but may expose sensitive URL contents. [Q1][Q3][Q6][Q14]
Security weaknesses
Unfiltered URLs are automatically shared with a remote web service, and that service supplies the popup interface, creating privacy and change-control risks. [Q3][Q6][Q7][Q8]
Signs of misuse
There is no clear evidence of deliberate tracking or broader misuse, but the service receives complete URLs whenever the popup opens. [Q6][Q8][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs permission and uses it to read the active tab's full URL. It has no website access, page access, storage, identity, or background worker.
Declares tabs as its sole permission and a popup as its only active component. — manifest.json:permissions and top-level fields
Queries the active tab and reads tab.url. — scripts/popup.js:1-5
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts, host_permissions, scripting, or activeTab entry. — manifest.json:top-level fields
Loads only scripts/popup.js and a remote iframe, not scripts/cite.js. — index.html:20-21
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It does not read password or form fields, but it sends the complete active-tab URL. URLs can contain sensitive search text, private resource identifiers, email addresses, reset links, or access tokens in their path or query string.
Places tab.url directly into the Citation Hero iframe query string without minimizing or filtering it. — scripts/popup.js:4-5
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Only tabs permission is declared. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of these capabilities. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Opening the popup sends the current tab's full URL to citationhero.io as the q parameter and loads that service in an iframe. The remote page can also receive data the user enters into its own UI.
Sets the iframe source to https://citationhero.io/extension-window?q=${tab.url}. — scripts/popup.js:1-5
The Citation Hero iframe fills the popup. — index.html:14-21
Does it download or run code, settings, or instructions supplied by a remote server?
The extension downloads and displays the entire popup application from citationhero.io. That remote site can change the UI and instructions at any time, but its cross-origin frame does not execute with the extension origin or gain extension services.
Embeds a full-window HTTPS iframe from citationhero.io. — index.html:14-21
Navigates the frame to the remote extension-window page. — scripts/popup.js:4-5
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After the user opens the popup, it automatically reads and submits the active tab URL without a separate confirmation. It does not run this collection continuously in the background.
window.onload calls getCurrentTab, then immediately updates the remote iframe URL. — scripts/popup.js:1-8
No background worker or content script is present. — manifest.json:top-level fields
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no browser override, proxy, management, or settings permission. — manifest.json:top-level fields
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains the complete active local logic. — scripts/popup.js:1-8
Deprecated packaged implementation is readable but inactive. — scripts/cite.js:1-267
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains no dynamic-code sink. — scripts/popup.js:entire file
Contains no eval or new Function sink; its timer uses a function callback. — scripts/cite.js:entire file
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads and transmits the active URL on each popup load. — scripts/popup.js:1-8
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Creates no identifier and uses no storage. — scripts/popup.js:entire file
Does not request cookies or storage. — manifest.json:permissions
Does it send cookies, session details, authentication data, or page contents elsewhere?
It does not access browser cookies or account sessions directly. However, it sends URLs intact, so any credential, invitation secret, password-reset token, or signed access parameter embedded in the current URL is also supplied to Citation Hero.
Appends unfiltered tab.url to the remote iframe address. — scripts/popup.js:4-5
No cookies or identity permission is declared. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content script or capture permission exists. — manifest.json:top-level fields
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Uses a full-size cross-origin citationhero.io iframe as the UI. — index.html:14-21
Only the packaged parent script accesses chrome.tabs before navigating the frame. — scripts/popup.js:1-5
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Local popup wrapper contains only the iframe and basic layout. — index.html:1-23
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission is declared. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or local-network access is declared. — manifest.json:permissions and top-level fields
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Separates the packaged popup script from the cross-origin remote frame. — index.html:20-21
Only changes iframe.src; it does not fetch or evaluate response text. — scripts/popup.js:1-8
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains neither web_accessible_resources nor externally_connectable. — manifest.json:top-level fields
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Labels itself a deprecated feature. — scripts/cite.js:1
Does not list cite.js as a content script or background script. — manifest.json:top-level fields
Loads popup.js only. — index.html:20-21
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
No background worker or content script is active. — manifest.json:top-level fields
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or scripting access exists. — manifest.json:top-level fields
Dormant code builds a citation overlay and clipboard button, not a webpage form rewrite. — scripts/cite.js:141-267