Is ColorFont | Color Picker and Font Picker safe?
ColorFont is medium risk. Clicking the extension's Check Links button collects the page's internal and external link URLs and sends them to the developer's Firebase function at us-central1-colorfont.cloudfunctions.net/checkLinkStatus for status checking.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Page links are sent to Firebase when you check link status
Clicking the extension's Check Links button collects the page's internal and external link URLs and sends them to the developer's Firebase function at us-central1-colorfont.cloudfunctions.net/checkLinkStatus for status checking.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user clicks the Check Links button.
The extension collects internal and external link URLs from the active page and sends them to a Firebase Cloud Function for status checking.
- Page link URLhttps://example.com/article
A full href from the active page can reveal destinations linked from the page you are viewing.
Dynamic analysis confirmed that the extension forwards the combined internal and external page links to the link-status endpoint after the button click.
Image data is sent to a Firebase converter when conversion is requested.
Using the image conversion feature sends base64-encoded image data to us-central1-colorfont.cloudfunctions.net/convertImage, including the image content, file name, and target format.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You request image format conversion.
The extension sends base64-encoded image data, fileName, and targetFormat to a Firebase Cloud Function.
- Page or uploaded image contentdata:image/png;base64,iVBORw0KGgo... (illustrative)
Image pixels from the active page or a local upload are included so the remote converter can process the file.
Dynamic analysis confirmed the conversion path sends FileReader base64 output to the Firebase convertImage endpoint when the user clicks convert.
What it can do
Permissions this extension asks for, as declared in version 2.2.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Show a panel beside the page
sidePanel
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Sign you in with your Google account
identity
Change your browser's font settings
fontSettings