Is Little Bee (Image/Audio/Video Screenshot/Video Download) safe?

Medium risk

Little Bee sends click telemetry with page URL, referrer, screen size, and an ID to extanl.jtcrpa.com.

Its content script runs on all websites and watches for clicks on elements marked with data-extanl-event attributes. When one fires, the background worker sends the page URL, referrer, screen size, event/custom values, extension language/version, and a stored random identifier to extanl.jtcrpa.com.

379522770v2.0.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Click telemetry is sent to extanl.jtcrpa.com from any website

Clicking marked page elements forwards page URL, referrer, screen size, event values, language, version, and persistent extension IDs to extanl.jtcrpa.com/api/send.

A stored random value can link this across sites to one install.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You click a page element that carries data-extanl-event attributes.

The extension did this

The extension forwards click telemetry, page URL, referrer, screen size, and persistent IDs to extanl.jtcrpa.com/api/send.

Captured request
POSTextanl.jtcrpa.com/api/send
Fields in the request
  • Current page URL
    https://example.com/watch?v=123 (illustrative)

    Shows which page was open when the click event was sent.

  • Referrer page
    https://example.com/search (illustrative)

    Shows the page that led to the current page when available.

  • Persistent extension storage value
    d7f3a1b2-4c5d-4e6f-9012-abcdef123456 (illustrative)

    Can link multiple requests back to the same extension install over time.

  • Page-provided event data
    {"event":"play","custom":"video-card"} (illustrative)

    Includes event and custom values read from matching data attributes on the clicked element.

What it can do

Permissions this extension asks for, as declared in version 2.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Watch every request your browser makes

    webRequest

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Start, monitor and manage your downloads

    downloads

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Little Bee (Image/Audio/Video Screenshot/Video Download) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • extanl.jtcrpa.com

    Little Bee (Image/Audio/Video Screenshot/Video Download) sends data to extanl.jtcrpa.com. One other extension we have analysed sends data here.

Updated 30 September 2026cjeondblmkphanbjmnkaahhamngobgmp