Is Colorway: Eyedropper & Color Picker Tool safe?

Colorway is a color-picker that, once opened on a tab, accepts page messages with no origin check to capture a screenshot or write its storage.

Colorway injects its picker UI into the active tab only after you click its toolbar icon or context-menu entry. While active on that tab, it registers a window message listener that does not verify the sender, so any script on the page can trigger a screenshot of the visible viewport returned to the requesting frame, or overwrite the extension's synced options and color history. These behaviors require the extension to have been opened on the tab first; they are not active on arbitrary pages by default.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.