Is Capture Master – Full Page Screenshot & Annotation Tool safe?
We analyzed Capture Master – Full Page Screenshot & Annotation Tool version 1.0.83's actual code and gave it a 78/100 trust score. A purpose-aligned…
Bottom line
A purpose-aligned screenshot tool with medium access risk and a moderate security concern, but no established abuse.
What it can access
It can capture visible page or selected-window content and store or export it, matching its screenshot purpose but potentially exposing sensitive information.[Q1][Q2][Q3][Q5]
Security weaknesses
User-supplied remote post data is inserted into extension page markup without escaping, which could enable injected content to run in the preview.[Q16]
Signs of misuse
The review found no unexplained collection, background uploading, deceptive changes, remote control, or other established misuse.[Q6][Q7][Q8][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can capture the active tab, inject capture controls into that tab, create tabs, save files, and store capture history. This access is broad enough to expose sensitive screen content but matches the advertised screenshot and export features.
Requests activeTab, scripting, tabs, downloads, storage, unlimitedStorage, and offscreen permissions, with host access limited to Gmail and Outlook. — manifest.json:8-24
Injects the packaged capture script into the current active tab only after a popup action. — popup.js:74-130
Captures the visible tab and receives locally generated image parts. — background.js:392-433
Which websites can it run on, and can it read or change what appears on those pages?
After a user starts a capture, it can inspect visible elements, scroll the page, temporarily hide or reposition elements, and capture page pixels. There is no persistent all-sites page access.
Uses activeTab and scripting rather than a manifest-declared all-sites content script. — manifest.json:8-24
Enumerates visible page elements, temporarily changes styles, and captures the chosen area. — content.js:2175-2448
Restores modified elements and the original scroll position after capture. — content.js:2917-2926
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
A screenshot can include messages, form text, payment details, or other sensitive information visible on screen. The code captures pixels rather than keylogging or directly reading input values.
Captures the visible tab to a PNG and stores visible element text and link metadata. — content.js:1758-1913
Uses chrome.tabs.captureVisibleTab to obtain the displayed page pixels. — background.js:392-408
Lets the user select a page region or element before capture. — content.js:876-1179
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads the active tab's title, URL/hostname, and visible link targets, and it can create downloads. It does not request cookies, history, bookmarks, or session services and no such collection was found.
Requests tabs and downloads but not cookies, history, bookmarks, identity, or webRequest. — manifest.json:8-24
Queries the active tab and uses its URL/title in the capture flow. — popup.js:74-78,204-217
Stores the captured page title, host, visible text, image sources, and links as local metadata. — content.js:1880-1901
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can capture a window or application selected in Chrome's display-media picker and can write an exported image to the clipboard. It does not read the clipboard, camera, microphone, location, or arbitrary files.
Calls getDisplayMedia and captures one frame from the stream selected in the browser picker. — offscreen.js:1-39
Window capture starts only after the user clicks the dedicated button. — popup.js:261-268
Writes a generated PNG to the clipboard after a user export action. — preview.js:9936-9950
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The optional X-post tool sends a pasted public post URL to services.vxtwitter.com. Explicit email export attaches the capture to a Gmail or Outlook draft; no background screenshot upload or unrelated analytics destination was found.
Rewrites the user-entered X/Twitter URL to api.vxtwitter.com and fetches its JSON response. — preview.js:7291-7313
Generates an attachment and invokes email export only from Gmail or Outlook export buttons. — preview.js:10036-10103
Opens the selected provider's compose page and passes the local attachment to its packaged attacher script. — background.js:534-600
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Fetches post JSON and renders author, text, and media fields; it does not pass them to a JavaScript execution API. — preview.js:7291-7351
Declares only packaged scripts and no remotely hosted background or content code. — manifest.json:1-48
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Capture and page-editing modes are bound to explicit popup buttons. — popup.js:258-306
Install/startup registers UI and commands; capture commands are triggered by user shortcuts or context-menu selection. — background.js:811-876
Email export runs from dedicated user-click handlers. — preview.js:10091-10103
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
The permission list contains no browser-setting, proxy, management, or search-provider permission. — manifest.json:8-24
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Identifies and licenses the packaged third-party libraries. — THIRD_PARTY_LICENSES.txt:1-200
Service-worker behavior is supplied as readable source. — background.js:1-876
Page capture and manipulation behavior is supplied as readable source. — content.js:1-3179
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The apparent Function text occurs in getPatternSrcFunction, not a Function constructor call. — Libs/fabric.min.js:1
No extension-page CSP relaxation for unsafe-eval is declared. — manifest.json:1-48
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Builds capture metadata containing title, host, visible text, image sources, and link targets. — content.js:1880-1913
Stores capture history and associated metadata in chrome.storage.local. — background.js:126-153,789-805
Uses activeTab and declares no browsing-history permission or always-on content script. — manifest.json:8-24
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Install/startup behavior sets a fixed uninstall URL and local UI state without generating an identifier. — background.js:811-826
Requests no identity or privacy-sensitive fingerprinting permission. — manifest.json:8-24
Does it send cookies, session details, authentication data, or page contents elsewhere?
A capture can be sent as an attachment to Gmail or Outlook when the user chooses email export. That is page content going to the intended mail service; no cookies, session tokens, or credentials are read or transmitted.
Creates the chosen capture format and starts Gmail or Outlook export from explicit buttons. — preview.js:10036-10103
Stores the attachment briefly, opens the selected mail compose page, and removes the temporary data after retrieval. — background.js:534-600
Host access is restricted to Gmail and Outlook and no cookies permission is present. — manifest.json:18-24
Does it record typing, form entries, clipboard contents, or screenshots?
Its core feature records screenshots of the active tab, a selected region, or a user-selected window. It does not record keystrokes or read clipboard contents; clipboard use is output-only.
Captures visible tab pixels as PNG data. — background.js:392-408
Captures one frame from a window chosen through getDisplayMedia. — offscreen.js:1-39
Writes a user-generated image to the clipboard rather than reading the clipboard. — preview.js:9936-9950
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Fetches server-controlled post JSON after a user supplies an X/Twitter URL. — preview.js:7291-7318
Builds media HTML and interpolates remote author, text, profile, and media fields directly into innerHTML without escaping. — preview.js:7254-7288,7340-7351
Does not relax the default extension-page script policy or expose a remote messaging entry point. — manifest.json:1-48
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Temporarily changes element styles to assemble screenshots. — content.js:2290-2400
Restores modified styles and scrolling when capture ends. — content.js:2880-2926
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It creates image/PDF downloads requested by the user and can suggest their filenames. It does not intercept traffic, alter request headers, redirect browsing, or configure a proxy.
Starts requested downloads and suggests filenames only for URLs tracked as its own pending downloads. — background.js:39-79
Handles explicit editor download requests using chrome.downloads.download. — background.js:643-653
Requests downloads but not webRequest, declarativeNetRequest, or proxy. — manifest.json:8-17
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission or localhost host access. — manifest.json:8-24
Uses the standard getDisplayMedia browser API rather than local software. — offscreen.js:1-39
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads packaged application scripts and libraries only. — manifest.json:1-48
Remote X-post data reaches an HTML sink but not eval, Function, script injection, or another execution API. — preview.js:7291-7351
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares neither externally_connectable nor web_accessible_resources. — manifest.json:1-48
Receives capture commands through chrome.runtime messaging and rejects messages whose sender is a tab. — content.js:1-112
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Lets the user save per-host element selectors locally for future screenshots. — content.js:1188-1520
Startup and command paths contain no remote targeting logic. — background.js:811-876
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is limited to capture, storage, downloads, email export, and UI state. — background.js:1-876
Declares only the packaged screenshot service worker and no remotely loaded worker or mining resource. — manifest.json:1-48
Does it change form fields or where a form sends its information?
During explicit email export it fills an empty Gmail subject/body and attaches the selected capture, or dispatches an attachment paste in Outlook. It does not change a form action, recipient, or destination and does not read existing message content.
Fills only blank compose fields and attaches the extension-provided file through Gmail's file input. — gmail-attacher.js:1-28,37-101
Dispatches the extension-provided attachment to the Outlook compose body without reading or changing recipients. — outlook-attacher.js:1-82
Runs the attacher only after the user chooses Gmail or Outlook export. — background.js:534-600