Is Mobile simulator - responsive testing tool safe?
Mobile emulator removes X-Frame-Options and Content-Type headers from all HTTP responses and weakens Content-Security-Policy across every site.
The extension registers a webRequest listener active on all URLs, not just simulator-activated tabs. It strips X-Frame-Options and X-Content-Type-Options headers unconditionally, and modifies Content-Security-Policy on non-Google origins by adding unsafe-inline to script-src, broadening frame-src and frame-ancestors, and injecting a hardcoded nonce. When the user activates the mobile simulator on a page, a Google Analytics snippet is also injected into that page, reporting the selected device type and the extension install date.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 4.22.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls> and 1 more
Watch every request your browser makes
webRequest
Run its own code inside the pages you visit
scripting
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Block and redirect the requests your browser makes
declarativeNetRequest
See every page you navigate to, as you navigate to it
webNavigation
Store data in your browser
storage
Add items to the right-click menu
contextMenus
Where it sends data
Destinations our analysis observed Mobile simulator - responsive testing tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Mobile simulator - responsive testing tool sends data to www.google-analytics.com. A widely used service: 388 other extensions we have analyzed send data here.