Is Convert HEIC to JPG safe?
Convert HEIC to JPG injects a hidden onlineapp.pro paywall iframe into every page and runs a leftover dev hot-reload client on localhost.
The extension runs a content script on every site (<all_urls>) at document load. When the toolbar icon is clicked it injects a hidden iframe from onlineapp.pro — a monetization domain separate from the product's heic-to-jpg.pro — into a shadow root on the page and lets that third-party origin open new windows via postMessage. The same content script also includes a leftover development hot-reload client that opens an unauthenticated WebSocket to ws://localhost:8081 and reloads the current tab on any 'do_update' message, which any local process bound to that port can trigger.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.8.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Start, monitor and manage your downloads
downloads
Where it sends data
Destinations our analysis observed Convert HEIC to JPG contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- onlineapp.pro
Convert HEIC to JPG sends data to onlineapp.pro. 5 other extensions we have analyzed send data here.
- onlineapp.live
Convert HEIC to JPG sends data to onlineapp.live. No other extension we have analyzed sends data here.
- onlineapp.stream
Convert HEIC to JPG sends data to onlineapp.stream. No other extension we have analyzed sends data here.