Is URL Scanner and QR Codes safe?
URL Scanner and QR Codes is medium risk. Opening the popup sends your active tab's URL and title to hybridapps.net as a base64-encoded parameter. We observed this request fire live, carrying a real page URL off the device.…
Who publishes itQuickQRCode - 1 other listing from the same operator, none carrying a finding
QuickQRCode - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 10k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Opening the QR popup sends your active tab URL and title to hybridapps.net
Opening the popup sends your active tab's URL and title to hybridapps.net as a base64-encoded parameter.
We observed this request fire live, carrying a real page URL off the device.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension's popup on any page to create a QR code.
The extension reads your current tab's URL and title and sends them to hybridapps.net.
Both values are base64-encoded into a single request parameter before leaving your device.
200 OK, returned a live shortlink for the submitted URL, confirming the server received and processed the transmitted page address.
The qrData parameter is your tab's URL and title base64-encoded, not encrypted. Anyone who can see the request can decode it back to plain text in one step.
{ "type": "link", "mode": "dynamic", "name": "YouTube", "data": { "link": "https://www.youtube.com/watch?v=N90_mnJuYck" }}- Current tab URLhttps://www.youtube.com/watch?v=N90_mnJuYck
The full web address of whatever page you have open when you use the QR feature.
- Page titleYouTube
The title of that page, sent alongside the URL.
- Extension reference IDQRExt-05-20
A fixed tag identifying this extension and its installed version to the receiving server.
- hybridapps.net
Primary destination for the encoded tab URL and title. Returns a shortened link back to the extension.
- amazonspot.net
Fallback destination used only if hybridapps.net does not respond. Receives the identical payload.
Decodes a captured qrData parameter back into the tab URL and title it carries, so you can verify what was actually sent.
- Node.js 18+
// Paste the qrData value from a captured hybridapps.net or amazonspot.net request URL below.const qrData = "eyJ0eXBlIjoibGluayIsIm1vZGUiOiJkeW5hbWljIiwibmFtZSI6IllvdVR1YmUiLCJkYXRhIjp7ImxpbmsiOiJodHRwczovL3d3dy55b3V0dWJlLmNvbS93YXRjaD92PU45MF9tbkp1WWNrIn19";const decoded = JSON.parse(atob(decodeURIComponent(qrData)));console.log(decoded);- 1Open DevTools Network tab, then use the QR feature.
- 2Copy the qrData value from the request URL.
- 3Paste it into the script and run node decode_qrdata.js.
The extension checks a remote file that can trigger in-app popups anytime
Each time you open the popup, the extension fetches a JSON file from dsnetx.web.app that can push a notification with arbitrary title and message text at any time, no Chrome Web Store update needed.
We observed this fetch fire live.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open the extension's popup, as you normally would to scan or create a QR code.
The extension fetches a remote JSON file that can tell it to display a notification with any title and message text it contains.
The message can render as an in-page banner or as a blocking browser alert() box, and its content can change at any time without a new Chrome Web Store release.
200 OK, returned {"global":{"exclude":[]},"private":[]}. No campaign was active at capture time, but the response matches the schema the extension parses to decide whether to show a notification.
- Message titleService Update
Headline text shown in the notification banner or alert box.
- Message bodyThanks for trying our new scanner. <b>Update now.</b>
Text shown to you. It can include HTML formatting such as bold text or links.
- Alert styleWEBALERT
Whether the message renders as an in-page banner or as a blocking browser alert() popup.
- Target versionsQRExt-05-20
Extension IDs and version numbers the message is aimed at, letting the operator target specific installs.
- dsnetx.web.app
Primary source for the message instructions, hosted on Google Firebase.
- dsnet.bitbucket.io
Fallback source used only if dsnetx.web.app does not respond, hosted on Bitbucket Pages.
Fetches the same msg.json endpoints the extension polls and prints any active notification payloads.
- Node.js 18+ (has global fetch)
const ENDPOINTS = [ 'https://dsnetx.web.app/apps/firelinks/msg.json', 'https://dsnet.bitbucket.io/apps/ext/msg/msg.json'];(async () => { for (const url of ENDPOINTS) { const res = await fetch(`${url}?ref=QRExt-05-20&r=${Math.random()}`); const json = await res.json(); console.log(url, JSON.stringify(json, null, 2)); }})();- 1Run with a fetch-capable Node.js (18+) or in a browser console.
- 2Execute node check_remote_messages.js.
- 3Inspect the global and private arrays for any live campaign.
What it can do
Permissions this extension asks for, as declared in version 2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
See the address and title of every tab you have open
tabs
Store data in your browser
storage