Is Nimbus Screen Capture: Screenshot, Edit, Annotate safe?

Clean risk

Nimbus Screen Capture embeds hardcoded OAuth secrets for Slack and Google and transmits a browser fingerprint to its vendor server.

The extension includes literal Slack and Google OAuth client_secret values in background.js, allowing anyone who unpacks the extension to impersonate the Nimbus app and complete OAuth token exchanges against Slack and Google APIs. On first run, the extension uses FingerprintJS2 to compute a hardware fingerprint from ~20 browser signals, stores it in localStorage, and transmits it to capture-pro.everhelper.me each time the user checks their premium status.

Nimbus Webv15.6.9Firefox Add-ons
2Risk
Who publishes it

Nimbus Web - no other listings under this identity, 10 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Nimbus Web
Website
nimbusweb.me/screenshot.php

Shared hosts - 10 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

capture-pro.everhelper.me
Also called by 2 other listings: classi-ai-선생님, ClassroomGo - AI無邊際 （老師）
help.everhelper.me
Also called by 2 other listings, including Web Clipper (Nimbus)
nimbus.everhelper.me
Also called by 2 other listings, including Web Clipper (Nimbus)
hase.su
Also called by 3 other listings, including Web Clipper (Nimbus)
s.nimbusweb.me
Also called by 3 other listings
nimbusweb.co
Also called by 4 other listings, including EverSync, EverSync - Sync bookmarks, backup your favorites.
bobbyvandersluis.com
Also called by 5 other listings
sync.everhelper.me
Also called by 5 other listings
everhelper.desk.com
Also called by 6 other listings, including EverSync, Live Start Page - Speed Dial
nimb.ws
Also called by 7 other listings, including classi-ai-선생님, ClassroomGo - AI無邊際 （老師）

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 15.6.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Add items to the right-click menu

    contextMenus

  • Read whatever you have copied to your clipboard

    clipboardRead

  • Write to your clipboard

    clipboardWrite

  • Show you desktop notifications

    notifications

Where it sends data

Destinations our analysis observed Nimbus Screen Capture: Screenshot, Edit, Annotate contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • googleapis.com

    Nimbus Screen Capture: Screenshot, Edit, Annotate sends data to googleapis.com. 4 other extensions we have analyzed send data here.

  • slack.com

    Nimbus Screen Capture: Screenshot, Edit, Annotate sends data to slack.com. One other extension we have analyzed sends data here.

  • capture-pro.everhelper.me

    Nimbus Screen Capture: Screenshot, Edit, Annotate sends data to capture-pro.everhelper.me. No other extension we have analyzed sends data here.

Updated 2 November 2026amo-448002