Is Full Page Capture - Screenshot Tool safe?

Medium risk

Full Page Capture bundles the Mellowtel SDK, which loads server-chosen URLs in hidden frames and returns page content.

After the user opts in on a mellow.tel page, the extension keeps a WebSocket open to ws.mellow.tel and receives commands naming URLs to load. It opens those URLs in hidden iframes, removes frame-blocking and CSP response headers, and sends the scraped HTML or markdown back to the server. This runs separately from the screenshot feature.

v1.0.1Chrome Web Store
49Risk
Who publishes it

11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.

Clock, Alarm, Timer & Stopwatch692MediumImage Downloader Assistant - Batch Save Images337MediumUndo Closed Tabs – Reopen Last Tab236MediumAlarm, Timer & Stopwatch for Browser230MediumQR Code Generator & Reader69MediumVideo Speed Controller - Universal Video Playback Speed59Medium5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Mellowtel SDK loads server-chosen pages in off-screen iframes, headers removed

Code analysis shows an embedded Mellowtel SDK that, after an opt-in on mellow.tel, takes URL commands from wss://ws.mellow.tel, loads them in off-screen iframes with CSP and X-Frame-Options removed, and returns page content.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

After opt-in, the Mellowtel server sends a command naming a URL to load.

Commands arrive over wss://ws.mellow.tel and are not tied to anything the user does.

The extension did this

The extension loads that URL in a off-screen iframe with security headers removed and returns the page content.

Content is returned as raw HTML or markdown, depending on the command flags.

Fields in the server command and returned result
  • Target URL
    https://example.com/products?page=2 (illustrative)

    Server-chosen address the browser is told to load, fetched from the user's own network and IP address.

  • Page HTML
    saveHtml: true

    The full outerHTML of the loaded page can be read and returned when saveHtml is set.

  • Page markdown
    saveMarkdown: true

    A Turndown text conversion of the page can be returned when saveMarkdown is set.

  • Request options
    method: GET | POST

    The command can set the HTTP method, headers and payload used for the load.

The code that does this

Response headers removed from every sub_frame (session rule 80045)

Readable version

DNR rule body

deobfuscated/background.js:47132-47170
action: {  type: "modifyHeaders",  responseHeaders: [    { header: "x-frame-options", operation: "remove" },    { header: "content-security-policy", operation: "remove" },    { header: "cross-origin-embedder-policy", operation: "remove" },    { header: "cross-origin-opener-policy", operation: "remove" },    { header: "cross-origin-resource-policy", operation: "remove" },    { header: "content-security-policy-report-only", operation: "remove" }  ]},condition: { resourceTypes: ["sub_frame"], urlFilter: "*://*/*" }
The code that does this

Iframe built on a server-supplied URL

Readable version

Credentialless iframe creation

deobfuscated/background.js:48353-48357
let d = document.createElement("iframe");d.id = t;d.credentialless = true;if (i) { d.setAttribute("sandbox", ""); if (s !== "") d.setAttribute("sandbox", s); }if (r !== "") d.setAttribute("data-id", r);d.src = e;   // e = URL supplied by the server commandd.onload = n;
Mellowtel endpoints contacted
    • ws.mellow.tel

    WebSocket receiving crawl commands and URLs to load.

    • api.mellow.tel

    Approval endpoint queried by the SDK before connecting.

    • www.mellow.tel

    Opt-in page opened on install; consent is recorded here, not in the extension.

Observation

Not observed running. Opt-in happens on an external page, and the server-driven XHR-hook and iframe-relay branches are absent from this build; the crawl iframe, header removal and scrape paths remain.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Full Page Capture - Screenshot Tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Full Page Capture - Screenshot Tool sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    Full Page Capture - Screenshot Tool sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

Updated 15 October 2026cmfoidiacmlllaifebpdflabafobibnk