Is Gemini & Nano Banana Watermark Remover — 1-Click Clean, Batch ZIP Export safe?
GRemover is medium risk. After the subscription flow opens, the extension repeatedly checks its subscription API using a stored token. Requests go to gremover.extensionfox.com/api/subscription/current with the token, sent every few seconds for up to 10 minutes.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Subscription polling repeatedly sends the stored account token.
After the subscription flow opens, the extension repeatedly checks its subscription API using a stored token.
Requests go to gremover.extensionfox.com/api/subscription/current with the token, sent every few seconds for up to 10 minutes.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The subscription flow is opened.
The extension starts recurring subscription-status checks and includes the stored account token in each request.
- Stored extension dataBearer abc123... (illustrative)
This request uses data kept by the extension for account authorization, including the token used to check subscription status.
Dynamic analysis observed 344 repeated subscription-status requests after the subscription flow was triggered. A planted marker value was transmitted in the authorization header, confirming that the stored token was included on each request.
Usage reports send subscription data after image processing.
When you process an image with this extension, it reports usage to gremover.extensionfox.com.
The request is tied to stored subscription data and includes a watermark-removal count and request identifier.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user processes an image with the watermark-removal workflow.
The extension sends a usage report containing stored subscription data, a count, and a request identifier.
- Stored subscription datasubscription_id: sub_12345 (illustrative)
Links the usage report to subscription-related extension storage rather than only to the current page action.
A later verification row confirmed the usage-reporting path from the extension code. An earlier dynamic-analysis attempt did not reach the endpoint because the workflow required a logged-in Gemini image-generation session.