Is SVG Gobbler safe?

Medium risk

SVG Gobbler sends SVG markup to a remote cloud function when converting to JSX, and transmits a usage counter to the same endpoint on each gobble action.

When a user opens the SVG-to-JSX (SVGR) preview panel, the extension POSTs the full SVG source along with the user's SVGR configuration to a Google Cloud Function hosted by the developer. Separately, each time the gobble action runs, the extension sends a count of collected SVGs to the same endpoint — a fire-and-forget request that also carries the user's IP address in network headers.

Ross Moodyv5.32.0Chrome Web Store
45Risk
Who publishes it

Ross Moody - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Ross Moody
Website
github.com/rossmoody/svg-gobbler

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

svggobbler.com
Also called by 1 other listing: SVG Gobbler
us-west2-svg-gobbler.cloudfunctions.net
Also called by 1 other listing: SVG Gobbler

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SVGR Preview Sends Full SVG Content to Remote Cloud Function

Opening the SVGR tab sends the complete SVG source, embedded metadata included, to a developer-run Google Cloud Function for server-side conversion.

Traffic showed a POST to us-west2-svg-gobbler.cloudfunctions.net, returning JSX.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open the SVGR tab in the SVG Gobbler extension panel.

The extension did this

The extension sends the full SVG markup and your SVGR configuration to a developer-operated Google Cloud Function.

Conversion runs on a remote server, not locally in your browser.

Captured request
POSThttps://us-west2-svg-gobbler.cloudfunctions.net/svg-gobbler-svgr

200 OK, cloud function returned JSX component code (confirmed during dynamic analysis)

Headers
Content-Type
application/json
Body
{  "type": "svgr",  "payload": {    "svg": "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\"><title>DA_VERIFY_MPBM_12345</title><path d=\"M12 2L2 7l10 5 10-5-10-5zM2 17l10 5 10-5M2 12l10 5 10-5\"/></svg>",    "config": {      "icon": false,      "typescript": false,      "titleProp": false,      "ref": false,      "memo": false    },    "state": {      "name": "MyIcon",      "componentName": "MyIcon"    }  }}
What SVG Gobbler sends to the remote cloud function
  • Full SVG source
    <svg xmlns="http://www.w3.org/2000/svg"><title>My Brand Icon</title><path d="M12 2L2 7..."/></svg>

    The complete SVG markup, including embedded metadata like title elements, IDs, and creator annotations from tools such as Figma or Sketch.

  • SVGR configuration
    {"icon":false,"typescript":false,"titleProp":true,"ref":false,"memo":false}

    Your current SVGR settings, including whether to generate TypeScript, add a title prop, use forwardRef, and other transform options.

  • Component name
    MyBrandIcon

    The React component name you entered for the output, sent as part of the SVGR state.

The code that does this

SVGR upload hook, index-BzvAbczI.js lines 81322-81362

Readable version
const useSvgrPreview = () => {  const [loading, setLoading] = useState(false);  const { dispatch, state: { currentString: svgString, preview } } = useAppState();  useEffect(() => {    setLoading(true);    (async () => {      const payload = {        type: "svgr",        payload: {          svg: svgString,           // full SVG markup from active tab          config: preview.svgr.config,          state: preview.svgr.state        }      };      try {        const result = await (          await fetch(ENDPOINTS.svgr, {  // us-west2-svg-gobbler.cloudfunctions.net            body: JSON.stringify(payload),            headers: { "Content-Type": "application/json" },            method: "POST"          })        ).text();        dispatch({ payload: result, type: "set-svgr-result" });      } catch (err) {        console.error(err);        dispatch({ payload: `😥 ${i18n("details_svgr_error")}`, type: "set-svgr-result" });      }      setLoading(false);    })();  }, [svgString, dispatch, preview.svgr.config, preview.svgr.state]);  return { loading };};
Remote endpoint receiving SVG content
    • us-west2-svg-gobbler.cloudfunctions.net

    Google Cloud Functions endpoint run by the SVG Gobbler developer. Receives full SVG markup and config, converts to JSX server-side, returns output.

Where it sends data

Destinations our analysis observed SVG Gobbler contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • us-west2-svg-gobbler.cloudfunctions.net

    SVG Gobbler sends data to us-west2-svg-gobbler.cloudfunctions.net. One other extension we have analysed sends data here.

Updated 30 September 2026mpbmflcodadhgafbbakjeahpandgcbch