Is QR Code Generator & Reader safe?

Medium risk

QR Code Generator & Reader bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames on your connection after opt-in.

After the user opts in, the extension connects to ws.mellow.tel and receives page URLs that it opens in hidden iframes on the user's browser. To allow this, it installs a rule that removes frame-blocking and content-security headers (X-Frame-Options, CSP, COEP, COOP, CORP) from sub-frame responses on all sites. The page content and headers loaded this way are handled by the Mellowtel service.

siegeappbrasilv1.0.6Chrome Web Store
49Risk
Who publishes it

siegeappbrasil - 11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
siegeappbrasil

Same store account

11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.

Clock, Alarm, Timer & Stopwatch692MediumImage Downloader Assistant - Batch Save Images337MediumUndo Closed Tabs – Reopen Last Tab236MediumAlarm, Timer & Stopwatch for Browser230MediumVideo Speed Controller - Universal Video Playback Speed59MediumMonitix – Stock & Crypto Price Alert & Tracker41Medium5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

QR extension SDK loads server-chosen pages in off-screen frames, strips headers

Code analysis shows that after opt-in the bundled Mellowtel SDK connects to ws.mellow.tel, loads server-supplied URLs in off-screen frames, and removes frame-blocking headers via a network rule.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You accept the Mellowtel opt-in offered after installing the extension.

The opt-in link opens on install while the status is not opted in.

The extension did this

The service worker connects to ws.mellow.tel and loads pages chosen by that server in off-screen frames.

Frames are created by pascoli.js from job parameters posted by the content script.

The code that does this

SDK construction and WebSocket endpoint in the shipped bundle

Readable version

SDK init (names restored)

background.js
const mellowtel = new Mellowtel("intgr-9hUsPptPGn");await mellowtel.initBackground();

Endpoints (names restored)

background.js
const WS_URL = "wss://ws.mellow.tel";const APPROVAL_URL = "https://api.mellow.tel/approval";
The code that does this

Header stripping rule 80045 on sub_frame responses

Readable version

Intent of the rule

background.js
const RULE_ID = 80045;updateSessionRules({ removeRuleIds: [RULE_ID], addRules: [{ id: RULE_ID, priority: 1,  action: { type: "modifyHeaders", responseHeaders: [    {header:"x-frame-options",operation:"remove"}, {header:"content-security-policy",operation:"remove"},    {header:"cross-origin-embedder-policy",operation:"remove"}, {header:"cross-origin-opener-policy",operation:"remove"},    {header:"cross-origin-resource-policy",operation:"remove"} ] } }] });
Data classes in scope of the off-screen-frame jobs
  • Request URL
    https://example.com/api/items?page=2

    The address of each request made inside a off-screen frame.

  • Method and headers
    GET; content-type: application/json

    How the request was made and the request and response headers.

  • Response body
    {"items":[{"id":4121}]}

    The content returned to the off-screen frame.

  • Timestamp and record id
    2026-09-14T10:22:41.118Z; burke_id set by server

    Ties each captured record to a time and a server-issued job.

Destinations named in the code
    • ws.mellow.tel

    WebSocket that delivers URLs to load in off-screen frames.

    • api.mellow.tel

    Approval endpoint polled by the service worker.

    • www.mellow.tel

    Opt-in, settings and uninstall-feedback pages.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed QR Code Generator & Reader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    QR Code Generator & Reader sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    QR Code Generator & Reader sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

Updated 15 October 2026afjjlnbbgojjefpnkfopdiajidjeijmb