Is DivMagic - Copy Style from any website safe?

High risk

DivMagic forwards selected page DOM content and page URLs to api.divmagic.com when export or save actions run.

After DivMagic is injected into the active tab, a page script can use its message bridge to trigger export or save flows for the selected element. Those flows send serialized DOM output plus page URL or XPath data to api.divmagic.com, and saved image bytes can be uploaded to cdn.divmagic.com.

DivMagicv2.1.22Chrome Web Store
72Risk
Who publishes it

DivMagic - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
DivMagic
Declared legal entity
DivMagic
Registered address
1207 Delaware Ave, Wilmington, DE 19806, US
Registered contact
DivMagic
Website
divmagic.com

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Selecting an Element Uploads Its Content to DivMagic Without Saving

An element click in DivMagic's select mode captures a screenshot plus HTML/CSS, sent 10s later, unprompted, with the URL, an XPath, and account ID to DivMagic's servers, flagged not saved, contradicting its no-collection claim.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You activate DivMagic's select mode (toolbar icon or Ctrl+Shift+X) and click a single element on any page.

You are not required to press Copy, Save, or Export.

The extension did this

About 10 seconds later, DivMagic uploads a screenshot of the element plus its HTML/CSS, the page's URL, and your account ID to its own servers, marked as a capture you never saved.

The upload fires even if you close the modal and do nothing else.

What DivMagic uploads about 10 seconds after you select an element, without a save action
  • The element's HTML and CSS
    <div class="post-content" style="font-family:Arial,sans-serif;color:#222">...</div>

    A full markup copy of the exact element you clicked, with computed styles inlined, for any element you select, not just ones you export.

  • The page you were on
    https://example.com

    The origin of the page containing the element you selected.

  • Your DivMagic account ID
    u_7f2c19ab (illustrative)

    A persistent identifier tying this capture to your DivMagic account.

  • XPath of the element
    /html/body/div[3]/section/article

    The exact DOM location of the selected element on the page.

  • Screenshot of the element
    https://cdn.divmagic.com/upload/2678528660.webp

    A rendered WEBP image of the element, uploaded to a per-capture URL moments before the HTML/CSS upload.

  • The not-saved-by-user flag
    true

    Set to true whenever you didn't press a save/export control, marking this specific upload as one you never chose to submit.

Captured request
POSThttps://api.divmagic.com/v1/private/component/save

HTTP 200; the JSON response body is discarded by the extension and not used client-side.

Headers
Content-Type
application/json
Body
{  "url": "https://example.com",  "xpath": "/html/body/div[3]/section/article",  "output": "<div class=\"post-content\" style=\"font-family:Arial,sans-serif;color:#222\">...</div>",  "id": "u_7f2c19ab",  "imageUrl": "https://cdn.divmagic.com/upload/2678528660.webp",  "hidden": true}
The code that does this

The code that captures and uploads the selected element, from the extension's shipping source.

Readable version

The element-selection handler

// Runs every time the user clicks an element in select mode.async function handleElementSelected(isWordpressExport = false) {  if (!selectedElement) return;  const account = await readStorage('divmagic-user-v2');  const screenshotUrl = await uploadScreenshot({ isSavedByUser: false });  const xpath = getXPath(selectedElement);  const html = serializeElementWithInlineStyles(selectedElement, { componentFormat: 'html', styleFormat: isWordpressExport ? 'external' : 'inline' });  if (isWordpressExport) {    // Explicit WordPress export path — user pressed an export control.    chrome.runtime.sendMessage({ source: 'modal', type: 'SAVE_ELEMENT', data: html, xpath, url: window.location.origin, id: account.id, imageUrl: screenshotUrl, isWordpress: true });  } else {    // Default path: fires 10s after every selection, no user action required.    // isSavedByUser is never set here, so the background handler will mark hidden:true.    setTimeout(() => {      chrome.runtime.sendMessage({ source: 'modal', type: 'SAVE_ELEMENT', data: html, xpath, url: window.location.origin, id: account.id, imageUrl: screenshotUrl });    }, 10000);  }}

The upload handler in the background service worker

// Handles the SAVE_ELEMENT message from the content script.if (message.source === 'modal' && message.type === 'SAVE_ELEMENT') {  let screenshotUrl = message.imageUrl;  if (screenshotUrl && typeof screenshotUrl !== 'string') {    const randomId = tenRandomDigits();    const uploadUrl = `https://cdn.divmagic.com/upload/${randomId}.webp`;    const imageBlob = new Blob([new Uint8Array(screenshotUrl)], { type: 'image/webp' });    await fetch(uploadUrl, { method: 'PUT', body: imageBlob, headers: { 'Content-Type': 'image/webp' } });    screenshotUrl = uploadUrl;  }  await fetch('https://api.divmagic.com/v1/private/component/save', {    method: 'POST',    headers: { 'Content-Type': 'application/json' },    body: JSON.stringify({      url: message.url,      xpath: message.xpath,      output: message.data,      id: message.id,      imageUrl: screenshotUrl,      hidden: !message.isSavedByUser,   // true on every non-export selection      isWordpress: message.isWordpress    })  });}
Where the captured element ends up
    • cdn.divmagic.com

    Receives the rendered screenshot of the selected element via PUT, moments before the HTML upload.

    • api.divmagic.com

    Receives the element's HTML/CSS, the page URL, the XPath, and the account ID via POST, flagged as not saved by the user when no save action was taken.

What it can do

Permissions this extension asks for, as declared in version 2.1.22. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Run its own code inside the pages you visit

    scripting

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

Where it sends data

Destinations our analysis observed DivMagic - Copy Style from any website contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.divmagic.com

    DivMagic - Copy Style from any website sends data to api.divmagic.com. No other extension we have analysed sends data here.

  • cdn.divmagic.com

    DivMagic - Copy Style from any website sends data to cdn.divmagic.com. No other extension we have analysed sends data here.

Updated 30 September 2026okpadhgilncoodafepkdmlneojcehclf