Is GCP Toolkit safe?
GCP Toolkit lets scripts on Lazada-family pages make the extension fetch any URL and return the response text.
On Lazada, Miravia and Daraz pages, a content script passes page messages to the background, which fetches the requested URL without any host allowlist and posts the response body back to the page. This bypasses cross-origin restrictions, so page scripts can read other sites or local network addresses. It appears to be an internal developer toolkit using this to load proxy scripts.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest
See which of your requests its blocking rules matched
declarativeNetRequestFeedback
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Keep running in the background while your browser is open
background