Is Live editor for CSS, Less & Sass - Magic CSS safe?

Medium risk

Magic CSS is medium risk. Magic CSS contacts the developer's metrics server on install, update, and launch, sending a persistent ID, User-Agent, OS, browser, language, saved-CSS count, open count. Address comes from remote config; fires only via flag, path is wired.…

webextensions.orgv8.22.5Chrome Web Store
49Risk
Who publishes it

WebExtensions Private Limited - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
webextensions.org
Declared legal entity
WebExtensions Private Limited
Registered address
1501, Satyam Imperial Heights, Plot 59, Sector 17, Roadpali, Kalamboli, Raigadh, Maharashtra 410218, IN

Same store account

1 other listing published from this account, 9k+ users between them, none of them carrying a finding.

Shared hosts - 9 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

nodesource.com
Also called by 2 other listings, including Live editor for CSS, Less & Sass - Magic CSS
ostechnix.com
Also called by 2 other listings, including Live editor for CSS, Less & Sass - Magic CSS
testpilot.firefox.com
Also called by 2 other listings, including Live editor for CSS, Less & Sass - Magic CSS
webextensions.org
Also called by 3 other listings, including Live editor for CSS, Less & Sass - Magic CSS
accounts-static.cdn.mozilla.net
Also called by 5 other listings, including NordVPN, NordVPN - a VPN proxy extension for Firefox
api.accounts.firefox.com
Also called by 5 other listings, including NordVPN, NordVPN - a VPN proxy extension for Firefox
content.cdn.mozilla.net
Also called by 5 other listings, including NordVPN, NordVPN - a VPN proxy extension for Firefox
oauth.accounts.firefox.com
Also called by 6 other listings
profile.accounts.firefox.com
Also called by 6 other listings, including NordVPN, NordVPN - a VPN proxy extension for Firefox

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Telemetry sends persistent device ID and browser fingerprint on install/update

Magic CSS contacts the developer's metrics server on install, update, and launch, sending a persistent ID, User-Agent, OS, browser, language, saved-CSS count, open count.

Address comes from remote config; fires only via flag, path is wired.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the extension, or it fetches a fresh remote config.

Also fires on each successful remote config fetch (event: 'configFetch').

The extension did this

The background service worker assembles a fingerprint payload and sends it to the developer's metrics server.

The destination hostname and path come from the remote config, not from hardcoded values in the extension source.

Fields included in the metrics payload (details query parameter)
  • Persistent device ID
    a3f1c27e-84b2-4d91-9f03-e6a7b5c01234

    A UUID generated on first run, stored permanently in chrome.storage.local. Links every telemetry event to your device across sessions.

  • Full User-Agent string
    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

    Your browser's complete User-Agent, including browser name, version, and OS details.

  • Operating system
    macOS

    Your OS platform derived from navigator.platform and navigator.userAgent.

  • Sites with saved CSS
    14

    Count of distinct origins for which you have stored CSS rules. Reflects the breadth of your browsing and customization activity.

  • Editor launch count
    47

    How many times you have opened the Magic CSS editor, read from chrome.storage.local.

  • Browser language
    en-US

    Your browser's language setting (navigator.language) and full language preference list.

When this fires

On every browser startup

Fires on extension install (event: 'install'), on version update (event: 'update'), and each time a fresh remote config is fetched from api.webextensions.org (event: 'configFetch'). The remote config is fetched at startup and then on a schedule driven by remoteConfig.nextUpdate (default 7 days).

The code that does this

detailsGenerator(), builds the payload sent to the metrics server

Readable version
// detailsGenerator() — lines 404-464 of background-magicss.bundle.js// Assembles the telemetry payload://   uuid          — persistent ID from chrome.storage.local (instance-uuid key)//   launchesCount — editor open count from magicss-execution-counter//   version       — extension version from manifest//   lang / langsList — navigator.language / navigator.languages//   os            — platform string (macOS, Windows, Linux, etc.)//   browser / browserVersion — detected from UA//   ua            — navigator.userAgent (full string)//   editMode      — 'css' or 'less' (user preference)//   theme / indent / storage — other preferences//   originsCount  — count of unique origins with saved CSS rules//// metricsUrlGenerator() serializes `details` as JSON and appends// it as the 'details' query param to://   remoteConfig.config.metricsApi.server + metricsApiCollectionPath// (server address comes from the live config at api.webextensions.org)
Data destinations
    • api.webextensions.org

    Developer-operated config server. Serves the remote config that enables telemetry and provides the actual metrics API hostname and collection path.

Mixpanel behavioral tracking links editor interactions to a persistent device ID

Magic CSS sends editor events to Mixpanel under the developer's account, tied to a persistent UUID tracking usage: editor opens, Sass conversions, beautify/minify, clipboard copies, rate-us clicks.

Fires via flag; token is hardcoded.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You use any feature of the Magic CSS editor, open it, run a conversion, copy code, or click prompts.

Events are fired from main.bundle.js via sendEventMessageForMetrics() for each discrete interaction.

The extension did this

The background service worker forwards each event to Mixpanel, linking it to your persistent device UUID.

mixpanel.identify(instanceUuid) was called at initialization, so every subsequent track() call is tied to the same identity across all sessions.

The code that does this

Mixpanel initialization and event forwarding (background-magicss.bundle.js lines 85-153)

Readable version
// Setup://   1. Check dev mode — skip tracking if running as unpacked extension//   2. Read instanceUuid (instance-uuid) from chrome.storage.local//   3. Call mixpanel.init('672f8c9aa876de5834bc48330f074412')//   4. Call mixpanel.identify(instanceUuid) — ties all future events to this device's UUID//// Event routing (sendEventMessageForMetrics in main.bundle.js line 14-30)://   Content script → chrome.runtime.sendMessage({type:'mixpanel', subType:'event', payload: {name, ...}})//   Service worker receives → checks useMixpanel feature flag → mixpanel.track(evt.name, evt)//// Tracked event names observed in main.bundle.js://   'rateUsOn_chrome', 'openGetIcon', 'lessOrSassToCss',//   'beautifyCode', 'minifyCode', 'copiedCodeToClipboard',//   'failedToCopyCodeToClipboard'
Data linked to your persistent UUID in each Mixpanel event
  • Persistent device ID (distinct_id)
    a3f1c27e-84b2-4d91-9f03-e6a7b5c01234

    The UUID in storage.local Mixpanel uses to link your events across sessions. Set via mixpanel.identify(), attached to every track() call.

  • Event name
    beautifyCode

    The editor action you performed, such as 'beautifyCode', 'lessOrSassToCss', or 'copiedCodeToClipboard'.

Data destination
    • api.mixpanel.com

    Mixpanel Inc. analytics. Receives tracked events under the developer's project (token 672f8c9aa876de5834bc48330f074412). Data stored in the US under Mixpanel's policy.

What it can do

Permissions this extension asks for, as declared in version 8.22.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Run its own code inside the pages you visit

    scripting

  • Run hidden pages in the background

    offscreen

Updated 30 September 2026ifhikkcafabcgolfjegfcgloomalapol