Is CSS Scan safe?

Low risk

CSS Scan fetches stylesheet URLs through its background page and writes the responses into a page-readable iframe.

When you activate CSS Scan, it scans stylesheet links and CSS imports on the current page and asks its background page to fetch those URLs. The returned stylesheet text is inserted into a hidden iframe that page scripts can read, which can expose cross-origin or local stylesheet responses to the active page.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

gvrizzov4.4Chrome Web Store
17Risk
Who publishes it

gvrizzo - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
gvrizzo
Registered address
Av Doutor Moura Ribeiro, 97, Apt 204 torre A, Santos, SP 11070-061, BR
Registered contact
Guilherme Vieira Rizzo

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

getcssscan.com
Also called by 1 other listing: Skipper - Tab management that works with ADHD brains
headwayapp.co
Also called by 6 other listings, including Speech to Text & Dictation - DictationDaddy

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 4.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

  • Write to your clipboard

    clipboardWrite

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026gieabiemggnpnminflinemaickipbebg