Is Snapchat Camera for Chrome - Public Preview safe?

Medium risk

Snapchat Camera for Chrome reports per-site usage events and UI interactions to Snapchat's servers on every page visited.

The extension runs a content script on all pages and sends telemetry — including the hostname of each site visited — to gcp.api.snapchat.com via protobuf payloads. It also tracks lens interactions, search queries, and UI events such as panel opens and watermark changes. Additionally, the extension's service worker silently uninstalls other Snapchat Camera extension versions (prototype and production) without user confirmation each time a tab changes.

Snapchatv1.0.28Chrome Web Store
48Risk
Who publishes it

Snap, Inc. - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Snapchat
Declared legal entity
Snap, Inc.
Registered address
2772 Donald Douglas Loop N, Santa Monica, CA 90405, US

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

auth.snapchat.com
Also called by 1 other listing: Bitmoji
snap.com
Also called by 3 other listings, including TermOver AI, Insighter Debugger - GTM, GA4, Meta Pixel, Google Ads & TikTok
gl.ch
Also called by 4 other listings, including 极光Tab-划时代的新标签页

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension uninstalls Snapchat prototype builds without a confirmation prompt

MediumunwantedCWE-506Dynamic sandbox

Snapchat Camera lists installed extensions via the management API on tab navigation, focus change, and tab activation.

What actually happens

You did this

You switch to a different browser tab or window.

Any tab activation, page load start, or window focus change fires the service worker's management check.

The extension did this

The worker lists every extension you have installed and uninstalls any Snapchat prototype or conflicting production build it finds, with no confirmation prompt.

chrome.management.getAll() runs on every event; chrome.management.uninstall() fires immediately with no user prompt if a target ID is matched.

The code that does this

Hardcoded target extension IDs (serviceWorker.js lines 13353-13356)

Readable version
const SNAPCHAT_EXTENSION_IDS = {  production: "mgijmfgdpljgnhcmokgeokdibogckgoj",  internal:   "caidjmglohhknimidodplllokmnfginh",  prototype:  "peafnkapicdbglljocjflflcfniikgcf"};

The code that does this

Uninstall logic in Tb() (serviceWorker.js lines 48705-48724)

Readable version
chrome.management.getAll((extensions) => {  const installed = ["production", "internal", "prototype"]    .filter(key => extensions.some(ext => ext.id === SNAPCHAT_EXTENSION_IDS[key]));  const hasPrototype = installed.includes("prototype");  const hasInternal  = installed.includes("internal");  const hasProduction = installed.includes("production");  // Remove prototype version unconditionally if present  if (hasPrototype) {    const proto = extensions.find(ext => ext.id === SNAPCHAT_EXTENSION_IDS.prototype);    if (proto) {      chrome.management.uninstall(proto.id, () => {        Logger.info(`Prototype version (${SNAPCHAT_EXTENSION_IDS.prototype}) uninstalled`);      });    }  }  // Remove production if internal build is also present  if (hasInternal && hasProduction) {    const prod = extensions.find(ext => ext.id === SNAPCHAT_EXTENSION_IDS.production);    if (prod) {      chrome.management.uninstall(prod.id, () => {        Logger.info(`Production version (${SNAPCHAT_EXTENSION_IDS.production}) uninstalled`);      });    }  }});

When this fires

On an interval

The management enumeration and uninstall check runs on every tab activation, every page load start, and every window focus change, potentially dozens of times per browsing session.

Scope of impact

The uninstall targets are Snapchat-internal builds (prototype and internal channel IDs), not arbitrary third-party extensions. If neither targeted ID is present in a user's browser, the getAll() call completes without any uninstall action. Dynamic analysis confirmed getAll() fires on every navigation but found no prototype ID present to trigger an actual uninstall in the test environment.

What it can do

Permissions this extension asks for, as declared in version 1.0.28. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Show a panel beside the page

    sidePanel

  • Sign you in with your Google account

    identity

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Run its own code inside the pages you visit

    scripting

  • See, disable and uninstall your other extensions, including your security ones

    management

Where it sends data

Destinations our analysis observed Snapchat Camera contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • accounts.snapchat.com

    Snapchat Camera sends data to accounts.snapchat.com. One other extension we have analyzed sends data here.

  • gcp.api.snapchat.com

    Snapchat Camera sends data to gcp.api.snapchat.com. No other extension we have analyzed sends data here.

Updated 30 September 2026mgijmfgdpljgnhcmokgeokdibogckgoj