Is Short URL (Bre.is) safe?

Medium risk

Short URL Bre.is is medium risk. When you open the Short URL (Bre.is) popup, the extension reads the current tab URL and sends it to the Bre.is shortening endpoint. The submitted data is the page URL, sent by POST to bre.is/api/short each time the popup is opened.

ChromeAppsv1.0.10Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Current tab URL sent to Bre.is whenever the popup opens.

When you open the Short URL (Bre.is) popup, the extension reads the current tab URL and sends it to the Bre.is shortening endpoint.

The submitted data is the page URL, sent by POST to bre.is/api/short each time the popup is opened.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open the extension popup.

The extension did this

The extension sends the current tab URL to the Bre.is shortener service.

Captured request
POSTbre.is/api/short
Fields in the request
  • Current tab URL
    https://example.com/article (illustrative)

    Identifies the page open when the popup is used.

Observation

Static verification confirmed that opening the popup reaches the background request that posts the tab URL to the shortening endpoint.

What it can do

Permissions this extension asks for, as declared in version 1.0.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Write to your clipboard

    clipboardWrite

  • Store data in your browser

    storage

Updated 21 September 2026gmcofljannieocjefhglfanemdmkafgg