Is Bypass Telegram Web safe?

Low risk

Bypass Telegram Web records authorization and cookie headers from browser requests and can copy captured tokens.

The extension watches outgoing requests across all URLs and stores Authorization, Cookie, and x-custom-header values by tab when those headers appear. When the popup's Get Token button is used on a tab with a Telegram bot or game iframe, it can copy a captured bearer token to the clipboard. It also redirects Telegram WebApp JavaScript on selected bot-game domains to a jsDelivr-hosted GitHub script and removes framing/security headers from pages and iframes.

BrewVNv3.2Chrome Web Store
19Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Authorization headers copied from recorded web requests

Bypass Telegram Web can read headers on every site.

Its worker records Authorization, Cookie, x-custom-header, URL, method, and origin for the active tab.

Get Token shows that Authorization (Bearer stripped) and copies it to clipboard.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You browse pages that make signed-in web requests, then open the extension popup and click Get Token.

The popup only copies a token after the click path runs, but request-header recording happens beforehand in the service worker.

The extension did this

The extension records selected request headers by tab and can copy a recorded Authorization value to your clipboard.

The copied value has the Bearer prefix removed when the recorded header starts with that prefix.

Fields the extension stores from matching requests
  • Authorization token
    Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjM0NTY3fQ.signature

    This can let a service recognize an already signed-in session or API request as yours.

  • Cookies
    sessionid=6f8b2c9e4d1a7b3c; csrftoken=Q7nL4pR2sT9vX1yZ

    Cookies can identify your browser session for the site that received the request.

  • Request URL
    https://example-game.example/api/v1/player/profile

    The URL shows which site and path were loaded when the sensitive header was present.

  • Request method
    POST

    The method adds context about whether the browser was fetching, submitting, or updating data.

  • Custom header
    X-Custom-Header: telegram-webapp-session

    Extra application headers can carry account, device, or app-specific routing context.

The code that does this

The shipped listener records Authorization and Cookie headers for all observed URLs

Readable version

Permission effect

manifest.json
const extensionPermissions = {  canInspectRequestHeaders: true,  observedHosts: ["<all_urls>"],  canWriteClipboard: true,  backgroundServiceWorker: "js/background.js",  popupPage: "popup/popup.html"};

Readable equivalent of the recorder

js/background.js
const requestsStoredByTabId = {};function rememberSensitiveHeaders(details) {  if (!details.requestHeaders || !details.tabId || details.tabId === -1) {    return;  }  const capturedHeaders = {};  for (const header of details.requestHeaders) {    const name = header.name.toLowerCase();    if (name === "authorization") {      capturedHeaders.authorization = header.value;    }    if (name === "cookie") {      capturedHeaders.cookie = header.value;    }    if (name === "x-custom-header") {      capturedHeaders["x-custom-header"] = header.value;    }  }  if (Object.keys(capturedHeaders).length === 0) {    return;  }  requestsStoredByTabId[details.tabId] = {    origin: details.initiator ? new URL(details.initiator).origin : "unknown",    data: [{      topLevelUrl: details.initiator ? new URL(details.initiator).origin : "unknown",      iframeUrl: details.url,      method: details.method,      ...capturedHeaders    }]  };}function handlePopupRequest(request, sender, sendResponse) {  if (request.action === "getRecordedRequests") {    sendResponse(requestsStoredByTabId[request.tabId]?.data || []);    return true;  }  if (request.action === "clearRecordedRequests") {    delete requestsStoredByTabId[request.tabId];    sendResponse({ success: true });    return true;  }}chrome.webRequest.onBeforeSendHeaders.addListener(rememberSensitiveHeaders, { urls: ["<all_urls>"] }, ["requestHeaders"]);chrome.runtime.onMessage.addListener(handlePopupRequest);
The code that does this

The popup click path reads the recorded header and writes it to the clipboard

Readable version

Popup trigger

popup/popup.html
const getTokenButton = document.querySelector("#getAuth");getTokenButton.textContent = "Get Token";loadScript("/getdata/gettokenn.js");

Readable equivalent of the click handler

getdata/gettokenn.js
function onGetTokenClicked() {  chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {    const activeTabId = tabs[0].id;    chrome.scripting.executeScript({      target: { tabId: activeTabId },      func: () => Array.from(document.querySelectorAll("iframe")).some((iframe) => {        const src = iframe.src || "";        return src && !src.includes("telegram.org") && (          src.includes("game") ||          src.includes("bot") ||          src.includes("app") ||          src.startsWith("https://")        );      })    }, (results) => {      const botGameFrameIsOpen = results?.[0]?.result === true;      if (!botGameFrameIsOpen) {        chrome.runtime.sendMessage({ action: "clearRecordedRequests", tabId: activeTabId });      }      chrome.runtime.sendMessage({ action: "getRecordedRequests", tabId: activeTabId }, (recordedRequests) => {        let tokenToShow = "";        if (botGameFrameIsOpen && recordedRequests?.length) {          for (const request of recordedRequests) {            tokenToShow = request.authorization.startsWith("Bearer ")              ? request.authorization.substring(7)              : request.authorization;          }        }        if (tokenToShow) {          showNoteMessageWithToken("success", t("tokenSuccess"), tokenToShow);          navigator.clipboard.writeText(tokenToShow);        } else {          showNoteMessage("error", t("tokenNotFound"));        }      });    });  });}document.addEventListener("DOMContentLoaded", () => {  document.getElementById("getAuth").addEventListener("click", onGetTokenClicked);});

What it can do

Permissions this extension asks for, as declared in version 3.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Watch every request your browser makes

    webRequest

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Write to your clipboard

    clipboardWrite

  • Show you desktop notifications

    notifications

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Bypass Telegram Web contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • cdn.jsdelivr.netwidely used

    Bypass Telegram Web sends data to cdn.jsdelivr.net. A widely used service: 32 other extensions we have analysed send data here.

Updated 30 September 2026jheaicmfgoefbdmadnhigbpdldafaokb