Is fontDownloader - Identify & download fonts safe?
We analyzed fontDownloader - Identify & download fonts version 0.0.25's actual code and gave it a 64/100 trust score. Useful font inspection is paired…
Bottom line
Useful font inspection is paired with moderate page access and automatic reporting of error details and the active page address.
What it can access
It can inspect styling on an activated page, query local fonts, download chosen files, and write selected styles to the clipboard, matching its font purpose.[Q1][Q2][Q5]
Security weaknesses
Automatic error reports include the full active-page address, creating a privacy weakness if that address contains sensitive information.[Q6][Q12]
Signs of misuse
The extension sends caught errors, diagnostics, and the active page address to the developer’s collector without a reported user prompt.[Q6]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
A user toolbar click grants active-tab access and injects the packaged font inspector into all frames of that tab.
Requests activeTab and scripting without permanent host access. — manifest.json:18-50
Injects scripts/content.js into all frames when the action is enabled. — background/background.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It reads computed font properties, stylesheet rules, font-face definitions, and shadow-root styles on the activated page.
Reads computedStyleMap for hovered or clicked elements. — scripts/hover-font-4RZLUE6A.js:1
Walks document and adopted stylesheets and extracts matching font-face rules. — scripts/font-info-popup-NRTZA7SL.js:1-119
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads only font-related computed style from the clicked element. — scripts/hover-font-4RZLUE6A.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores an installation ID, reminder timestamps, missing shortcuts, and promotion or donation state locally.
Creates extUserId and stores shortcut state on install. — background/background.js:1
Stores review and donation reminder timestamps. — scripts/promo-popup-handler-ZXFQ42FF.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It downloads selected fonts, can query installed local fonts after browser permission, and writes selected CSS values to the clipboard.
Uses queryLocalFonts and creates an object-URL download after the user's action. — options/options.js:7
Downloads selected font URLs and writes chosen CSS properties to the clipboard. — scripts/font-info-popup-NRTZA7SL.js:1-119
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Caught errors are automatically sent to the developer's bug collector with diagnostics and the active tab's full URL; font requests also contact their source websites.
Forwards caught font-processing errors to the background worker. — scripts/font-info-popup-NRTZA7SL.js:1
Appends sender.tab.url and posts the error, stack, browser, version, and timestamp to bug-collector.collectionrail.workers.dev. — background/background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Contains a remote promotion fetch, but no packaged caller or import was found. — scripts/extension-promotion-popup-GZRKOR2I.js:53-61
The active post-download handler loads only packaged review and donation dialogs. — scripts/promo-popup-handler-ZXFQ42FF.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Action click toggles content-script injection and removal. — background/background.js:1
Opens font details when the user clicks an element. — scripts/hover-font-4RZLUE6A.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings, proxy, or privacy permissions. — manifest.json:43-50
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Minified code retains descriptive URLs, message names, and straightforward event flow. — background/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Parses CSS with browser stylesheet APIs and packaged functions. — scripts/font-info-popup-NRTZA7SL.js:1-119
Uses fixed packaged handlers only. — background/background.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Adds sender.tab.url to the error stack before uploading, and uses the active URL in the explicit report-site Gmail draft. — background/background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a random installation ID used in uninstall feedback and an optional donation link; it is not sent on ordinary browsing.
Creates extUserId and embeds it in the uninstall-feedback URL. — background/background.js:1
Includes the stored ID in a Ko-fi URL opened only after a user click. — scripts/donation-request-popup-6XL364VL.js:104-124
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission or permanent site access. — manifest.json:43-50
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The keydown listener handles only Escape to close extension popups. — scripts/hover-font-4RZLUE6A.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable interface. — manifest.json:1-50
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It adds font-information, review, and donation UI to the activated page without changing the page's existing content or forms.
Adds a packaged status output element. — scripts/content.js:1-23
Renders a shadow-DOM font information popup. — scripts/font-info-popup-NRTZA7SL.js:8-119
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It fetches cross-origin stylesheets after an explicit origin-permission prompt and downloads selected font files from their source URLs.
Requests the specific stylesheet origin before fetching it. — background/background.js:1
Parses font URLs and starts a download after the user's choice. — scripts/font-info-popup-NRTZA7SL.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:43-50
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote page assets are parsed as stylesheet metadata or downloaded as fonts. — scripts/font-info-popup-NRTZA7SL.js:1-119
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no external page messaging interface. — manifest.json:1-50
Runtime messages are extension-internal activation commands. — scripts/hover-font-4RZLUE6A.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Toggles the injected inspector and requests origin access when needed. — background/background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runtime behavior is limited to font inspection and popup handling. — scripts/hover-font-4RZLUE6A.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reads computed font style and changes only extension-created UI. — scripts/hover-font-4RZLUE6A.js:1