Is Enable right click - allow copy & select safe?

High risk

Allow copy is high risk. This extension records every website you visit and sends it to a developer-controlled server: destination URL, referring page, response type, and install ID, sent automatically. Only the options page can disable reporting.

Allow copy&selectv1.0.8Chrome Web Store
74Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Browsing history sent to developer's Sentry server on every page load

This extension records every website you visit and sends it to a developer-controlled server: destination URL, referring page, response type, and install ID, sent automatically.

Only the options page can disable reporting.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any website in your browser.

No special action is required, any top-level page load, including those on banking, healthcare, or private sites, triggers the reporting.

The extension did this

The extension packages the URL, referrer, and your install's unique ID and sends them to a developer-controlled server.

The Sentry envelope is posted to cory.boostgroove.com/api/61/envelope/ regardless of which website you visited.

Captured request
POSThttps://cory.boostgroove.com/api/61/envelope/?sentry_key=8de612c2df5c4b60944af84ef6e7927b&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.120.4

dynamic analysis captured a 1499-byte envelope confirming the visited URL, referrer, and persistent userId in plaintext.

Headers
Content-Type
application/x-sentry-envelope
Body
{"event_id":"a1b2c3d4e5f6","sent_at":"2026-06-04T20:14:31.000Z","sdk":{"name":"sentry.javascript.browser","version":"7.120.4"}} {"type":"event"} {"message":"onCompletedListener","contexts":{"req":{"fileDate":"2026-06-04T20:14:31.002Z","deviceTimestamp":1749073471002,"userId":"3c4ac620-f549-48f1-8f73-706e330a97c7","referrerUrl":"https://www.facebook.com/","targetUrl":"https://www.facebook.com/checkpoint/eas_blocked_country_name_flow/","requestType":"main_frame","contentType":"text/html; charset=utf-8","statusCode":200,"foreground":1}},"release":"1.0.9","platform":"javascript"}
Fields transmitted on each navigation
  • Visited URL
    https://www.facebook.com/checkpoint/eas_blocked_country_name_flow/

    The full address of every page you load, including paths and query strings on sensitive sites.

  • Referring page
    https://www.facebook.com/

    The URL of the page you were on before navigating, revealing your browsing sequence.

  • Install ID
    3c4ac620-f549-48f1-8f73-706e330a97c7

    A UUID generated once at install and stored permanently, linking every navigation report to your specific browser install.

  • Content type
    text/html; charset=utf-8

    The MIME type returned by the page, which can reveal whether you visited a document, API endpoint, or media resource.

  • HTTP status code
    200

    Whether the page loaded successfully or resulted in an error; a 401 or 403 can indicate you attempted to access a restricted resource.

  • Device timestamp
    1749073471002

    Millisecond-precision local time of each visit, allowing the developer to reconstruct your browsing timeline.

What's stored on your device

Stores a permanent install ID and the reporting flag, which defaults to 1 (enabled) unless the user opens options and disables it.

Location
chrome.storage.local
Contents
{  "id": "3c4ac620-f549-48f1-8f73-706e330a97c7",  "automaticReport": 1}
The code that does this

Navigation reporting, shipped (minified) vs deobfuscated

Readable version
// background.js:14167-14204 chrome.webRequest.onBeforeSendHeaders.addListener((e => { "main_frame" === e.type && "outermost_frame" === e.frameType && function captureHeaders(e) { const requestId = e.requestId, referrerUrl = a(e.requestHeaders, "referer") || a(e.requestHeaders, "referrer") || "", targetUrl = e.url || "", tabId = e.tabId; t.set(requestId, { tabId, referrerUrl, targetUrl }); }(e); }), { urls: ["http://*/*", "https://*/*"] }, ["requestHeaders", "extraHeaders"]); chrome.webRequest.onCompleted.addListener((function(e) { "outermost_frame" == e.frameType && "main_frame" == e.type && async function sendReport(e) { const requestId = e.requestId, requestData = t.get(requestId); if (!requestData) return; const { tabId, referrerUrl, targetUrl } = requestData, requestType = e.type, statusCode = e.statusCode ?? 0, contentType = (a(e.responseHeaders, "content-type") || "").toString().toLowerCase(); // Skip errors, redirects, and navigation with no content-type if (0 === statusCode || statusCode >= 400 || !contentType) return; // u() checks automaticReport flag then calls Sentry.captureMessage u({ fileDate: (new Date).toISOString(), deviceTimestamp: Date.now(), userId: await i(), // persistent UUID from chrome.storage.local referrerUrl, targetUrl, requestType, contentType: contentType || null, statusCode, foreground: await c(tabId) }, "onCompletedListener"); t.delete(requestId); }(e); }), { urls: ["http://*/*", "https://*/*"] }, ["responseHeaders", "extraHeaders"]);
Data destination
    • cory.boostgroove.com

    Self-hosted Sentry instance run by the developer (boostgroove.com). Receives full browsing-history: URLs, referrers, install IDs. Project 61, DSN 8de612c2df5c4b60944af84ef6e7927b.

What it can do

Permissions this extension asks for, as declared in version 1.0.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.0.8, which we have not unpacked yet.

  • Read and change your data on every site you visit

    *://*/*

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Watch every request your browser makes

    webRequest

Updated 30 September 2026mlloloooolpffjkjaclpfpeednngpjon