Who makes QRコード機能・サテライトオフィス?

QRコード機能・サテライトオフィス is published by Sateraito Office. The same operator publishes 7 other store listings, 1 of which carry a security finding.

Is QRコード機能・サテライトオフィス safe?

Medium risk

QRコード機能・サテライトオフィス is medium risk. When the QR scanner decodes a web address, the extension sends that address to qrcode.sateraito.jp to look up the page title. Non-URL QR contents stay local; URL results are added to a GET request before being shown and optionally opened.

Sateraito Officev1.0.6Chrome Web Store

45Risk

Who publishes it

Sateraito Office - 7 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Sateraito Office

Website

www.sateraito.jp/contact/

Same store account

7 other listings published from this account, 86k+ users between them. 1 of them carries a finding.

Chromebook利用状況管理・サテライトオフィス50k+Low サテライトオフィス・先生生徒画面共有機能(生徒) for Google Classroom10k+Low サテライトAI.議事録作成AI10k+Low %E3%82%B5%E3%83%86%E3%83%A9%E3%82%A4%E3%83%88ai%E3%83%BB%E3%83%97%E3%83%A9%E3%82%B0%E3%82%A4%E3%83%B3chatgpt%E3%80%81gemi9k+Medium S.コンテキストガジェット＆ウェブメニュー5k+Low サテライトオフィス・先生生徒画面共有機能(授業) for Google Classroom1k+Medium 1 more listing in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Scanned QR URLs are sent to Sateraito for title lookup

When the QR scanner decodes a web address, the extension sends that address to qrcode.sateraito.jp to look up the page title.

Non-URL QR contents stay local; URL results are added to a GET request before being shown and optionally opened.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-200
Source: Dynamic sandbox

What actually happens

You did this

You scan a QR code or drop an image into the extension.

The QR detector returns decoded text in the popup.

The extension did this

If the decoded text is a web address, the extension sends that address for page-title lookup.

If the decoded text is not a URL, the same handler appends it locally without making this title-lookup request.

Data placed in the title-lookup request

Scanned web address
https://www.sateraito.jp/
This reveals the destination encoded in the QR code you scanned.
Title lookup path
/get_title_url?url=https%3A%2F%2Fwww.sateraito.jp%2F
This tells the receiving service that the URL is being resolved by this QR-code feature.

Captured request

GEThttps://qrcode.sateraito.jp/get_title_url?url=https%3A%2F%2Fwww.sateraito.jp%2F

The code expects HTTP 200 and uses responseText as the displayed history title.

The code that does this

The QR detect handler builds the title-lookup request

Readable version

Show shipped source

Readable URL test helper

data/window/common.js

function validURL(a){return!!/[(http(s)?):\/\/(www\.)?a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%_\+.~#?&\/\/=]*)/.test(a)}function completeUrl(a){return a};

Readable detect handler and GET request

data/window/index.js

API_DOMAIN = "https://qrcode.sateraito.jp";checkPermission().then(function() {  navigator.mediaDevices.enumerateDevices().then(function(a) {    var b = 0;    a.forEach(function(a) {      "videoinput" == a.kind && (listDeviceId[b] = a.deviceId, b++)    });    currentCameraId = listDeviceId[elementSelectedDevice];    tools.vidoe.on(currentCameraId)  }).catch(function(a) {    console.log(a.name + ": " + a.message)  })});qrcode.on("detect", function(a) {  qrcode.draw(a, canvas);  tools.stream && tools.stream.active && tools.vidoe.off();  var b = new Date,    c = b.getFullYear() + "/" + (b.getMonth() + 1) + "/" + b.getDate() + " " + b.getHours() + ":" + b.getMinutes() + ":" + b.getSeconds();  validURL(a.data) ? (document.getElementById("loading").classList.remove("hide"), b = new XMLHttpRequest, b.onreadystatechange = function() {    4 == this.readyState && 200 == this.status && (tools.append(a, this.responseText, c, null, !0), showUrlDetect(a.data), document.getElementById("loading").classList.add("hide"),      chrome.storage.local.get(["auto_start"], function(b) {        b.auto_start && window.open(a.data, "_blank")      }))  }, b.open("GET", API_DOMAIN + "/get_title_url?url=" + encodeURIComponent(a.data), !0), b.send()) : (tools.append(a, null, c, null, !0), document.getElementById("qr-detect").textContent = a.data)});

Readable local history write after title lookup

data/window/index.js

append: function(a, b, c, d, e) {  b = void 0 === b ? null : b;  c = void 0 === c ? null : c;  e = void 0 === e ? !1 : e;  var f = "q-" + hashCode(a.data);  b = null != b ? b : a.symbol;  c = null != c ? c : a.date;  d = document.createElement("div");  d.id = f;  d.classList.add("history-item");  f = document.createElement("p");  f.textContent = b;  d.appendChild(f);  validURL(a.data) ? (f = document.createElement("a"), f.classList.add("history-url"),    f.textContent = a.data, f.setAttribute("href", a.data), f.setAttribute("target", "_blank"), d.appendChild(f)) : (f = document.createElement("pre"), f.classList.add("history-text"), f.textContent = a.data, d.appendChild(f));  f = document.createElement("p");  f.classList.add("history-date");  f.textContent = c;  d.appendChild(f);  d.setAttribute("data-url", a.data);  historyEle.insertAdjacentElement("afterbegin", d);  e && (prefs.history.unshift({    data: a.data,    symbol: b,    date: c  }), prefs.history = prefs.history.slice(0, prefs.max), chrome.storage.local.set({    history: prefs.history  }));  d.addEventListener("click", historySelect, !1)}

What's stored on your device

After a URL QR code is processed, the extension keeps a local history entry containing the scanned address and the title text it received.

Location: chrome.storage.local key 'history'

Contents

{  "data": "https://www.sateraito.jp/",  "date": "2026/7/14 10:30:00",  "symbol": "Sateraito Office"}

External service receiving the scanned URL

- qrcode.sateraito.jp
Sateraito title-resolution endpoint that receives the scanned URL in the url query parameter.