Is Notix: Notion Web Clipper safe?

High risk

Notix: Notion Web Clipper sends active-page cookies, localStorage, page text, URL, and title to its Notix side panel.

When the remote Notix side panel signals that it is ready, the extension asks the active tab for page data and forwards the response into the embedded Notix iframe. That response includes selected content, full page text, the page URL and title, cookies, localStorage, and the site host; the same iframe can also request a screenshot of the active tab.

Notixv1.4.4Chrome Web Store
73Risk
Who publishes it

Notix - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Notix
Website
notix.so/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Notix side panel receives active-page cookies and storage

Opening the Notix side panel can make the extension request tab data and forward it into the Notix iframe at notix.so/app/sidepanel: cookies, localStorage, visible text, URL, title, selection, selected HTML, thumbnail URL, and host.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You open the Notix side panel while a webpage is active.

The side panel hosts a Notix iframe that can send a readiness message to the extension page.

The extension did this

The extension asks the active tab for page data and forwards the result to the Notix iframe.

The response includes cookies, browser storage, page text, URL, title, selected content, thumbnail URL, and host.

Fields assembled by the content script before the side-panel response
  • Page cookies
    session_id=8f2c1a9b; theme=dark (illustrative)

    Cookies can identify your signed-in session or account context for the active website.

  • Browser storage
    {"workspaceId":"notion-7d31","lastView":"settings"} (illustrative)

    Local browser storage can contain site identifiers, saved application state, and tokens used by the page.

  • Selected content
    Quarterly roadmap notes (illustrative)

    Any text or HTML you selected on the page is included with the page-data response.

  • Full page text
    Account settings Billing Team members API access (illustrative)

    Visible text from the active page can reveal document content, account details, and internal page labels.

  • Page URL
    https://workspace.example.com/account/settings (illustrative)

    The URL identifies the exact page you had open when the side panel requested data.

  • Page title
    Account Settings - Workspace Admin (illustrative)

    The title adds readable context about the active page, even when the URL is not descriptive.

  • Page host
    workspace.example.com (illustrative)

    The host identifies which website supplied the collected page data.

  • Thumbnail URL
    https://workspace.example.com/assets/card.png (illustrative)

    A page preview image can reveal the source site or document being clipped.

Captured request
GEThttps://notix.so/app/sidepanel

The extension side-panel page embeds this remote iframe; the page-data payload is then delivered to the iframe via window.postMessage rather than an HTTP request body.

The code that does this

Source path from side-panel readiness to active-page data collection

Readable version

Readable side-panel bridge

main.js
function register(browser, extensionId) {  const iframeElement = document.getElementById('notix-iframe');  browser.runtime.onMessage.addListener((message) => {    iframeElement.contentWindow.postMessage(message, '*');  });  window.onmessage = (event) => messageListener(event);  const messageListener = async (evt) => {    const data = evt.data;    switch (data.msg) {      case 'NOTIX_READY':        browser.runtime.sendMessage(extensionId, { msg: 'getPageData' });        break;      default:    }  };}

Readable active-tab relay

background.js
if (request.msg === 'getPageData') {  chrome.tabs.query({ active: true }).then((tabs) => {    chrome.tabs.sendMessage(tabs[0].id, { cmd: 'get-page-data' });  });}

Readable page-data collection

content-script.js
if (request.cmd === 'get-page-data') {  const selection = getHTMLOfSelection();  const selectionText = window.getSelection().toString();  const payload = {    selection,    selectionText,    thumbnail: getThumbnail(),    innerText: document.body.innerText,    url: document.URL,    title: document.title,    cookie: document.cookie,    localStorage: JSON.stringify(window.localStorage),    host: window.location.host  };  chrome.runtime.sendMessage({ id: 'NOTIX_READY_RESPONSE', payload });}
Remote destination involved in the side-panel data flow
    • notix.so

    Hosts the side-panel iframe that receives extension messages, including the NOTIX_READY_RESPONSE page-data payload.

What it can do

Permissions this extension asks for, as declared in version 1.4.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

  • Show a panel beside the page

    sidePanel

Where it sends data

Destinations our analysis observed Notix: Notion Web Clipper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • notix.so

    Notix: Notion Web Clipper sends data to notix.so. No other extension we have analysed sends data here.

Updated 30 September 2026fmnbhafoldgblmdmhflflnjlfjcgpnog