Is Capacities Web Extension safe?

Medium risk

Capacities Web Extension exposes a popup any website can use to relay privileged commands to the service worker with no origin check.

Any website can embed the extension's popup.html in an iframe and postMessage arbitrary commands to it. The popup relays those messages directly to the service worker via chrome.runtime.sendMessage, with no origin validation. An attacker page can read the active tab's URL and title, retrieve all stored user spaces and preferences, overwrite extension state, save attacker-supplied bookmarks to the user's Capacities account, or wipe chrome.storage.local entirely.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

v1.5.10Chrome Web Store
44Risk
Who publishes it

Capacities Labs GmbH - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Declared legal entity
Capacities Labs GmbH
Registered address
St. Martinsweg 3, St. Wendel 66606, DE
Registered contact
Michael von Hohnhorst

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

app.capacities.io
Also called by 5 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.5.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on app.capacities.io

    https://app.capacities.io/

  • Read and change your data on portal.capacities.io

    https://portal.capacities.io/

  • Read and change your data on localhost:3333

    http://localhost:3333/

  • Read and change your data on 18.192.220.44:8000

    http://18.192.220.44:8000/

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

Updated 2 November 2026jdliiagcaloddeneiaofnaifmckpgccd