Is UpNote Web Clipper safe?
We analyzed UpNote Web Clipper version 1.2.2's actual code and gave it a 82/100 trust score. UpNote Web Clipper appears purpose-aligned and…
Bottom line
UpNote Web Clipper appears purpose-aligned and user-triggered, but its all-sites page access and article transfer deserve caution.
What it can access
It can inspect ordinary pages across all HTTP and HTTPS sites, which fits clipping but is broad. [Q1][Q2] On macOS it sends selected or cleaned article data to UpNote after a click. [Q5][Q6]
Security weaknesses
The package shows no remote command path, exposed privileged files, or live-page form changes; its main weakness is broad page visibility. [Q2][Q16][Q21][Q24]
Signs of misuse
There is no evidence of tracking, credential collection, deceptive changes, hidden work, or remote control; the observed transfer matches saving a requested clip. [Q6][Q12][Q14][Q23]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has no named Chrome services permissions, but its declared page access can read every HTTP and HTTPS page. That broad host access is consistent with a general-purpose clipper and the code uses it only after the user clicks the toolbar button.
Declares no named permissions and injects contentScript.js on *://*/*. — manifest.json:9-17
The only trigger is chrome.action.onClicked, which asks the clicked tab to extract an article. — background.js:1
Which websites can it run on, and can it read or change what appears on those pages?
The page access can inspect page text, markup, title, URL, computed visibility and the user's current selection on any ordinary website. It works on a cloned document and does not modify the live page.
Loads the content script on all HTTP and HTTPS pages. — manifest.json:13-17
Clones document, reads computed styles and selection, then runs packaged Readability against the clone. — contentScript.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Uses selection or Readability extraction; packaged Readability cleans form controls and no input/change/submit listener exists. — contentScript.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
No cookies, history, bookmarks, downloads or tabs permission is declared. — manifest.json:9-17
Uses sendMessage and tabs.update only in response to a toolbar click. — background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It sends a clip to the locally installed UpNote application through a custom upnote:// URL after the user clicks. It does not access local files, location, camera, microphone, clipboard or installed-app inventory.
Builds an upnote://x-callback-url/clipper deep link containing the clip or current URL. — contentScript.js:1
Navigates the clicked tab to the returned deep link. — background.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
On macOS, the outgoing clip contains selected or cleaned article HTML, page title, excerpt, URL and a readability flag. On other platforms it contains only the page URL.
Serializes html, title, excerpt, url and readerable into the UpNote deep link on macOS, otherwise serializes url only. — contentScript.js:1
Receives the deep-link string and opens it in the active tab after the click. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Contains the bundled Readability implementation and clipping logic with no fetch, XMLHttpRequest, WebSocket or dynamic import. — contentScript.js:1
Only relays a packaged message and opens the returned local-app deep link. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
chrome.action.onClicked is the sole initiator of extractArticle and tabs.update. — background.js:1
Extraction runs only when an extension message has message equal to extractArticle. — contentScript.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings permissions, overrides or proxy configuration. — manifest.json:9-18
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Webpack bundle contains Readability plus a short clipping routine; strings and control flow remain inspectable. — contentScript.js:1
Includes the original background source in sourcesContent. — background.js.map:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Complete bundled script contains no eval call, Function constructor or timer API. — contentScript.js:1
Background worker contains only toolbar-click message and navigation logic. — background.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
The click handler is the only trigger. — background.js:1
Reads window.location.href only while constructing the requested clip. — contentScript.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
No storage permission is declared. — manifest.json:9-18
Uses navigator.platform only to select full-article versus URL-only UpNote behavior, not to construct an identifier. — contentScript.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission is declared. — manifest.json:9-17
Clip fields are html, title, excerpt, url and readerable; no cookie or token source exists. — contentScript.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads window.getSelection during a requested clip; no key, input, submit, clipboard or capture listener/API exists. — contentScript.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Internal chrome.runtime.onMessage listener accepts only message equal to extractArticle. — contentScript.js:1
No externally_connectable declaration or web-accessible script is present. — manifest.json:1-26
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Normalizes relative anchor and image URLs against the current page in the cloned clip; no affiliate destination or campaign parameter exists. — contentScript.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is declared. — manifest.json:9-18
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Constructs an upnote://x-callback-url/clipper URL; no localhost address or native-messaging API appears. — contentScript.js:1
No nativeMessaging permission is declared. — manifest.json:9-18
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
JSON.stringify and encodeURIComponent serialize the user-requested article for UpNote; no corresponding execution sink exists. — contentScript.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable or web_accessible_resources section. — manifest.json:1-26
Listens only through chrome.runtime.onMessage and does not listen for page postMessage events. — contentScript.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Applies one content script uniformly to all HTTP and HTTPS pages. — manifest.json:13-17
Only platform check selects macOS full-article versus URL-only behavior; it does not hide risky behavior from reviewers. — contentScript.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Starts work only from the toolbar-click event. — background.js:1
Performs a finite DOM clone and parse with no recurring timer or worker. — contentScript.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Clones document before extraction and removes input, textarea, select, button and form-like content from the clone; no live-page form mutation exists. — contentScript.js:1