Is Chroma Color Picker safe?

Medium risk

Chroma Color Picker bundles the Mellowtel SDK, which loads server-chosen URLs in hidden frames after an opt-in.

After the user accepts a 'Support the extension for free' prompt, the extension keeps a WebSocket open to ws.mellow.tel and receives URLs to load in hidden frames from the user's browser. It removes CSP and frame-blocking headers so those pages can be loaded and read, and uploads the captured page HTML to Mellowtel's storage. The prompt does not mention bandwidth sharing, crawling or third parties, and none of this relates to color picking.

v1.0.1Chrome Web Store
49Risk
Who publishes it

11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.

Clock, Alarm, Timer & Stopwatch692MediumImage Downloader Assistant - Batch Save Images337MediumUndo Closed Tabs – Reopen Last Tab236MediumAlarm, Timer & Stopwatch for Browser230MediumQR Code Generator & Reader69MediumVideo Speed Controller - Universal Video Playback Speed59Medium5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Bundled Mellowtel SDK loads server-chosen URLs in frames after a vague opt-in

Code analysis shows a bundled SDK that, after a one-click opt-in, connects to ws.mellow.tel and loads server-supplied URLs in frames while removing CSP and frame headers.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You click Accept on a modal titled 'Support the extension for free'.

The modal text does not mention bandwidth, crawling or third parties.

The extension did this

The extension opens a WebSocket to ws.mellow.tel and runs URL-loading jobs sent by that server.

The code that does this

Opt-in modal accept handler and the install-time opt-in page

Readable version

Modal strings

_locales/en/messages.json
"mellowtelTitle": { "message": "Support the extension for free" },"mellowtelBody": { "message": "Would you like to help this extension for free? Enable Mellowtel to support development." }

WebSocket endpoint

background.js
Ba = "wss://ws.mellow.tel", Ca = [3e4, 6e4, 3e5, 6e5, 12e5, 36e5]
The code that does this

Session rule that removes frame-blocking and CSP headers on sub-frames

Readable version

Rule 80050

background.js
id: 80050,action: {  type: "modifyHeaders",  requestHeaders: [{ header: "Origin", operation: "remove" }],  responseHeaders: [    { header: "Access-Control-Allow-Origin", operation: "set", value: "*" },    { header: "Access-Control-Allow-Methods", operation: "set", value: "GET, POST, PUT, DELETE, OPTIONS" },    { header: "Access-Control-Allow-Headers", operation: "set", value: "Content-Type" }  ]},condition: { urlFilter: "*://*/*", resourceTypes: ["image"] }
What the SDK flow touches, per code analysis
  • Server-chosen URLs
    wss://ws.mellow.tel (job channel)

    Pages the remote server tells the extension to load in frames.

  • Page HTML
    saveHtml / saveMarkdown job flags

    Job options can save HTML or markdown of the loaded page.

  • Upload target
    background.js:55840 signed upload

    Results are uploaded through signed S3 URLs.

  • Network address
    Your public IP address

    Requests to loaded sites originate from your connection and IP address.

Hosts contacted by the SDK
    • ws.mellow.tel

    WebSocket channel that delivers jobs after opt-in.

    • api.mellow.tel

    Approval endpoint requested by the SDK.

    • www.mellow.tel

    Opt-in page opened on install.

    • mellowtel-bucket.s3.us-east-1.amazonaws.com

    Hosts the per-ID kill-switch file the SDK fetches.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Chroma Color Picker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Chroma Color Picker sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    Chroma Color Picker sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

  • Mellowtel

    Chroma Color Picker sends data to Mellowtel. Named as a recipient by 2 other extensions we have analysed.

Updated 15 October 2026ghcgolhjnajkjeogfjkaakdfohebocfa