Is Clipbox Tab safe?
Clipbox Tab is medium risk. Pressing Ctrl+C on any site, Clipbox Tab reads the selected text and page address, saving each new pair in Chrome's synced storage. Copied text from webmail, account pages, documents, or forms is kept with the page it came from.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Ctrl+C selections are saved with page URLs
Pressing Ctrl+C on any site, Clipbox Tab reads the selected text and page address, saving each new pair in Chrome's synced storage.
Copied text from webmail, account pages, documents, or forms is kept with the page it came from.
You copy selected text on a web page with Ctrl+C.
The page can be any site where the extension's content script runs.
The extension reads the selected text and saves it with the page URL.
It skips empty selections and duplicate text-and-URL pairs, then writes new entries to synced extension storage.
| Field | Value | Why it matters | |
|---|---|---|---|
Copied selection | Q3 renewal discount approved (illustrative) | This is the exact text you selected before pressing Ctrl+C. It can include text from messages, documents, account pages, or form fields. | |
Source page | https://mail.example.com/inbox/18472 (illustrative) | This ties the copied text to the page where you selected it. | |
Saved list entry | [{"text":"Q3 renewal discount approved","url":"https://mail.example.com/inbox/18472"}] (illustrative) | Each new text-and-page pair is added to the front of a saved list, so older copied selections can remain in the extension's storage. |
This synced record keeps copied page text together with the page address where you selected it.
chrome.storage.sync key 'clipboard'{
"clipboard": "[{\"text\":\"Q3 renewal discount approved (illustrative)\",\"url\":\"https://mail.example.com/inbox/18472 (illustrative)\"}]"
}The copy-shortcut handler that writes the saved entry
document.body.addEventListener("keydown", async function handleCopyShortcut(event) {
event = event || window.event;
var key = event.which || event.keyCode;
var isCtrlPressed = event.ctrlKey ? event.ctrlKey : (key === 17 ? true : false);
if (key == 67 && isCtrlPressed) {
var selection = window.getSelection();
if (selection) {
var selectedText = selection.toString().trim();
if (!selectedText) {
return;
}
var savedClipboardEntry = {
text: selectedText,
url: window.location.href
};
var alreadySaved = clipboard.some(function (item) {
return item.text == savedClipboardEntry.text && item.url == savedClipboardEntry.url;
});
if (!alreadySaved) {
clipboard.unshift(savedClipboardEntry);
chrome.storage.sync.set({
"clipboard": JSON.stringify(clipboard)
}, function () { });
}
}
}
}, false);The manifest runs the content script on every website
contentScripts = [{
matches: ["<all_urls>"],
js: ["scripts/content-scripts.js"]
}];