Is Web Color Inverter Tool safe?

Medium risk

Web Color Inverter Tool sends each completed tab navigation's hostname with a persistent UUID to tracker01.paradisesv.net.

When a tab finishes loading, Web Color Inverter Tool reads the page URL, extracts only the hostname, and posts it with a locally stored UUID. The UUID is created on install or update and lets tracker01.paradisesv.net link those visited hostnames to the same browser over time.

johnchen88723v1.1.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Color Inverter sends every visited hostname and a persistent ID to a tracker

Every completed page load sends its hostname and an install-time UUID to tracker01.paradisesv.net, regardless of the color-inversion toggle.

The same UUID repeats each time, letting the server rebuild your browsing history.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any website and the page finishes loading.

This happens during ordinary browsing, not just at install.

The extension did this

The extension's background service worker sends the site's hostname and a persistent ID to tracker01.paradisesv.net.

This runs on every completed navigation while the extension is enabled.

Captured request
POSThttps://tracker01.paradisesv.net/urlvisited

Observed during dynamic analysis: 14 matching POST requests captured across one browsing session covering six distinct hostnames, each carrying the same UUID.

Headers
Content-Type
application/x-www-form-urlencoded
Body
uuid=c39559ee-26ad-4322-862f-238e962bb365&url=www.amazon.com
What each beacon contains
  • Site you visited
    www.amazon.com

    The hostname of every page you finish loading is sent to the tracker.

  • Persistent device ID
    c39559ee-26ad-4322-862f-238e962bb365

    A UUID generated once at install and reused forever, letting the tracker link every visit to the same profile.

What's stored on your device

This identifier is created once at install and never rotates, so every hostname reported afterward is tagged with the same ID.

Location
chrome.storage.local key 'uuid'
Contents
{  "uuid": "c39559ee-26ad-4322-862f-238e962bb365"}
Where the data ends up
    • tracker01.paradisesv.net

    Receives the hostname of every page you finish loading, tagged with a persistent per-install UUID, building a visit history over time.

Check if you're affected

Scans an unpacked extension's background script for the tracking beacon endpoint and persistent-UUID storage key.

Requires
  • Python 3.8+
check_tracker_calls.py · py
#!/usr/bin/env python3"""Detector: flags the navigation-tracking beacon in an unpacked extension.Scans an unpacked Chrome extension's JS for the tracker01.paradisesv.netbeacon and the chrome.storage.local 'uuid' key it reuses on every request."""import reimport sysfrom pathlib import PathENDPOINT_PATTERN = re.compile(r"tracker01\.paradisesv\.net/urlvisited")UUID_KEY_PATTERN = re.compile(r"chrome\.storage\.local\.get\(['\"]uuid['\"]\)")def scan(root: Path) -> int:    hits = 0    for js_file in root.rglob("*.js"):        try:            text = js_file.read_text(errors="ignore")        except OSError:            continue        if ENDPOINT_PATTERN.search(text):            print(f"[BEACON] {js_file}: references tracker01.paradisesv.net/urlvisited")            hits += 1        if UUID_KEY_PATTERN.search(text):            print(f"[UUID]   {js_file}: reads a persistent 'uuid' key from chrome.storage.local")            hits += 1    if hits == 0:        print("No matches found. This copy does not reference the known beacon or UUID pattern.")    return hitsif __name__ == "__main__":    if len(sys.argv) != 2:        print("Usage: python3 check_tracker_calls.py <path-to-unpacked-extension>")        sys.exit(1)    scan(Path(sys.argv[1]))
How to run it
  1. 1Unpack the extension's .crx into a folder.
  2. 2Run: python3 check_tracker_calls.py <path-to-unpacked-folder>.
  3. 3Review any matches printed.

What it can do

Permissions this extension asks for, as declared in version 1.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Web Color Inverter Tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • tracker01.paradisesv.net

    Web Color Inverter Tool sends data to tracker01.paradisesv.net. No other extension we have analysed sends data here.

Updated 30 September 2026emaaonojkbcccdpmcejdndgldpbpbhbb