Is Enable right click - allow copy & select safe?
Allow copy is high risk. This extension records every website you visit and sends it to a developer-controlled server: destination URL, referring page, response type, and install ID, sent automatically. Only the options page can disable reporting.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Browsing history sent to developer's Sentry server on every page load
This extension records every website you visit and sends it to a developer-controlled server: destination URL, referring page, response type, and install ID, sent automatically.
Only the options page can disable reporting.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any website in your browser.
No special action is required, any top-level page load, including those on banking, healthcare, or private sites, triggers the reporting.
The extension packages the URL, referrer, and your install's unique ID and sends them to a developer-controlled server.
The Sentry envelope is posted to cory.boostgroove.com/api/61/envelope/ regardless of which website you visited.
dynamic analysis captured a 1499-byte envelope confirming the visited URL, referrer, and persistent userId in plaintext.
- Content-Type
- application/x-sentry-envelope
{"event_id":"a1b2c3d4e5f6","sent_at":"2026-06-04T20:14:31.000Z","sdk":{"name":"sentry.javascript.browser","version":"7.120.4"}} {"type":"event"} {"message":"onCompletedListener","contexts":{"req":{"fileDate":"2026-06-04T20:14:31.002Z","deviceTimestamp":1749073471002,"userId":"3c4ac620-f549-48f1-8f73-706e330a97c7","referrerUrl":"https://www.facebook.com/","targetUrl":"https://www.facebook.com/checkpoint/eas_blocked_country_name_flow/","requestType":"main_frame","contentType":"text/html; charset=utf-8","statusCode":200,"foreground":1}},"release":"1.0.9","platform":"javascript"}- Visited URLhttps://www.facebook.com/checkpoint/eas_blocked_country_name_flow/
The full address of every page you load, including paths and query strings on sensitive sites.
- Referring pagehttps://www.facebook.com/
The URL of the page you were on before navigating, revealing your browsing sequence.
- Install ID3c4ac620-f549-48f1-8f73-706e330a97c7
A UUID generated once at install and stored permanently, linking every navigation report to your specific browser install.
- Content typetext/html; charset=utf-8
The MIME type returned by the page, which can reveal whether you visited a document, API endpoint, or media resource.
- HTTP status code200
Whether the page loaded successfully or resulted in an error; a 401 or 403 can indicate you attempted to access a restricted resource.
- Device timestamp1749073471002
Millisecond-precision local time of each visit, allowing the developer to reconstruct your browsing timeline.
Stores a permanent install ID and the reporting flag, which defaults to 1 (enabled) unless the user opens options and disables it.
- Location
- chrome.storage.local
{ "id": "3c4ac620-f549-48f1-8f73-706e330a97c7", "automaticReport": 1}Navigation reporting, shipped (minified) vs deobfuscated
// background.js:14167-14204 chrome.webRequest.onBeforeSendHeaders.addListener((e => { "main_frame" === e.type && "outermost_frame" === e.frameType && function captureHeaders(e) { const requestId = e.requestId, referrerUrl = a(e.requestHeaders, "referer") || a(e.requestHeaders, "referrer") || "", targetUrl = e.url || "", tabId = e.tabId; t.set(requestId, { tabId, referrerUrl, targetUrl }); }(e); }), { urls: ["http://*/*", "https://*/*"] }, ["requestHeaders", "extraHeaders"]); chrome.webRequest.onCompleted.addListener((function(e) { "outermost_frame" == e.frameType && "main_frame" == e.type && async function sendReport(e) { const requestId = e.requestId, requestData = t.get(requestId); if (!requestData) return; const { tabId, referrerUrl, targetUrl } = requestData, requestType = e.type, statusCode = e.statusCode ?? 0, contentType = (a(e.responseHeaders, "content-type") || "").toString().toLowerCase(); // Skip errors, redirects, and navigation with no content-type if (0 === statusCode || statusCode >= 400 || !contentType) return; // u() checks automaticReport flag then calls Sentry.captureMessage u({ fileDate: (new Date).toISOString(), deviceTimestamp: Date.now(), userId: await i(), // persistent UUID from chrome.storage.local referrerUrl, targetUrl, requestType, contentType: contentType || null, statusCode, foreground: await c(tabId) }, "onCompletedListener"); t.delete(requestId); }(e); }), { urls: ["http://*/*", "https://*/*"] }, ["responseHeaders", "extraHeaders"]);- cory.boostgroove.com
Self-hosted Sentry instance run by the developer (boostgroove.com). Receives full browsing-history: URLs, referrers, install IDs. Project 61, DSN 8de612c2df5c4b60944af84ef6e7927b.
What it can do
Permissions this extension asks for, as declared in version 1.0.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.0.8, which we have not unpacked yet.
Read and change your data on every site you visit
*://*/*
See the address and title of every tab you have open
tabs
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Watch every request your browser makes
webRequest