Is screenshot-to-pdf safe?

Medium risk

screenshot-to-pdf injects a Cloudinary image into the active page after each screenshot capture.

When you capture a screenshot, the extension stores the screenshot locally and injects a notification script into the active tab. That script adds an image loaded from Cloudinary, causing the page to request the image from Cloudinary with browser request metadata such as IP address, URL, and referrer.

v1.1.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Screenshot notification loads a Cloudinary image into the active tab

Pressing Ctrl+Q to capture a screenshot makes the extension inject a Cloudinary-hosted notification image into the page.

Loading it makes the browser request Cloudinary from the tab, exposing your IP and page URL/referrer.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user presses Ctrl+Q to capture a screenshot.

The extension did this

The extension injects a Cloudinary-hosted notification image into the active tab, causing the page to request that image.

Captured request
GEThttps://res.cloudinary.com/diu5vyuxy/image/upload/v1723394284/cjxma2iulo7espgdotsj.png
Fields in the request
  • Your IP address
    203.0.113.10 (illustrative)

    Cloudinary receives the network address used to load the notification image.

  • Your page URL
    https://example.com/account (illustrative)

    The active page address can be associated with the image request through browser request context.

  • Your referrer
    https://example.com/current-page (illustrative)

    The current page may be sent as referrer information when the image is loaded.

What it can do

Permissions this extension asks for, as declared in version 1.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Where it sends data

Destinations our analysis observed screenshot-to-pdf contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • res.cloudinary.com

    screenshot-to-pdf sends data to res.cloudinary.com. One other extension we have analysed sends data here.

Updated 30 September 2026gelhpneijkjockolljcanbnghimbhfbj