Is Screen Dimmer safe?

Medium risk

Screen Dimmer loads a hidden onlineapp.pro paywall iframe on every page you visit.

Screen Dimmer runs a content script on all websites at page load and adds a hidden iframe from onlineapp.pro. That request can include browser network metadata such as the visited page URL, referrer, and IP address.

screendimmer.extv1.3Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Paywall iframe request on every page visit

Screen Dimmer was observed making a content-script GET to onlineapp.pro/paywall/322?v=2.

The manifest runs the paywall script on all URLs at page start and builds a hidden iframe there, disclosing page context to onlineapp.pro.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open an ordinary web page with the extension installed.

No popup click or dimmer activation is needed for the content scripts to start.

The extension did this

The extension adds a non-visible paywall iframe that requests onlineapp.pro.

Dynamic analysis observed the content-script-triggered request to the paywall URL.

Captured request
GEThttps://onlineapp.pro/paywall/322?v=2

Captured as a content-script-triggered request during dynamic analysis.

What the iframe request can expose
  • Page context
    https://example.org/research/report

    Lets the remote paywall host receive request metadata associated with the page you just opened.

  • Referrer information
    https://example.org/research/report

    Can reveal the page context that caused the iframe request, depending on browser referrer policy for that site.

  • Network address
    198.51.100.42

    Identifies the network location used to contact the onlineapp.pro server.

  • Paywall identifier
    322

    Ties the request to this extension's configured paywall placement.

The code that does this

The shipped code registers all-page scripts and creates the paywall iframe

Readable version

Readable manifest equivalent

manifest.json
content_scripts: [  {    matches: ["<all_urls>"],    js: ["overlay.js", "wall.1.0.3.js"],    run_at: "document_start"  }]

Readable paywall initialization

wall.1.0.3.js
init: function(paywallId, callback, root) {  if (!this._initPromise) {    this.paywallId = paywallId;    this._paywallDocumentRoot = root != null ? root : document;    this._initPromise = new Promise(resolve => {      this._addEventHandler("init", event => {        if (event.data.type === "state" && event.data.state.hasOwnProperty("visibility_status")) {          this.isInitialized = true;          this._removeEventHandler("init");          resolve(true);        }      });      window.addEventListener("message", this._globalEventHandler.bind(this), false);      this._createAndAppendIframe();    });  }  return this._initPromise;}

Readable iframe creation

wall.1.0.3.js
_createAndAppendIframe: function() {  window.requestAnimationFrame(() => {    const appendIframe = () => {      const iframe = this._paywallDocumentRoot.createElement("iframe");      iframe.src = "https://onlineapp.pro/paywall/".concat(this.paywallId, "?v=2");      iframe.id = "paywall-".concat(this.paywallId);      iframe.style.display = "none";      const container = this._paywallDocumentRoot.body || this._paywallDocumentRoot;      if (container) {        container.appendChild(iframe);      } else {        console.warn("[PAYWALL ERROR] Paywall container not found");      }    };    if (this._paywallDocumentRoot.readyState === "loading") {      this._paywallDocumentRoot.addEventListener("DOMContentLoaded", appendIframe);    } else {      appendIframe();    }  });}

Readable configured paywall ID

wall.1.0.3.js
paywall.init("322");
External host contacted by the content script
    • onlineapp.pro

    Receives the paywall iframe request created by wall.1.0.3.js from pages where the content script runs.

What it can do

Permissions this extension asks for, as declared in version 1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Screen Dimmer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • onlineapp.pro

    Screen Dimmer sends data to onlineapp.pro. 5 other extensions we have analysed send data here.

Updated 21 September 2026fbkkfkmgbjdnhkeihngeemdpdfkipehh