Is Materio Selection Clipper safe?

Medium risk

Materio Selection Clipper sends user identity and clipper API traffic from its side panel to LogRocket.

When the side panel starts, it initializes LogRocket for materio-clipper and identifies the signed-in Materio user by id, name, and email. With LogRocket's default network capture enabled, request and response headers and bodies for Materio clipper API calls, including auth, project scope, and clip submissions with product details, URLs, notes, pricing, images, vendors, and attachments, are sent to r.logr-in.com.

Materiov2.10Chrome Web Store
45Risk
Who publishes it

Materio - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Materio
Website
www.materio.co/help

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

cdn.lrkt-in.com
Also called by 3 other listings, including MarkUp.io

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Materio clipper data is sent to LogRocket without network sanitizers.

Materio Selection Clipper's side panel starts LogRocket without request or response sanitizers, so clipper API bodies, your page URL, form input, page content, tab details, and Materio identity info are sent to r.logr-in.com/i.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You take an action in the Materio side panel.

The extension did this

The extension initializes LogRocket without network sanitizers, allowing clipper API request and response bodies plus Materio identity details to be captured.

Captured request
POSTr.logr-in.com/i
Fields in the request
  • Form input
    Install in east conference room (illustrative)

    Clipper form values can describe what you are saving into Materio, including notes or product details.

  • Page URL
    https://shop.example.com/product/123 (illustrative)

    The clipped page address can identify the product or vendor page you are adding to Materio.

  • Page content
    Walnut task chair, $249, vendor image URL (illustrative)

    Captured page content can include product names, pricing, images, and vendor details from the page being clipped.

  • Tab details
    Product Details - Example Vendor (illustrative)

    Tab metadata can provide browsing context for the clipped page.

Observation

Dynamic analysis confirmed the LogRocket setup and the save-clip flow that posts clip data after a user action.

What it can do

Permissions this extension asks for, as declared in version 2.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on app.materio.co

    https://app.materio.co/*

  • Show a panel beside the page

    sidePanel

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Materio Selection Clipper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • r.logr-in.com

    Materio Selection Clipper sends data to r.logr-in.com. No other extension we have analysed sends data here.

Updated 30 September 2026jnbhdcnhfbnfehmopknkcdbnhgiedobi