Is Web for Telegram safe?
Web for Telegram renders a remote message from its developer's server into the page without sanitizing it on first display.
The extension periodically fetches a "push message" from oinkandstuff.com and shows it to the user in a toast notification. The first time this message is displayed, it is inserted into the Telegram Web page as raw HTML instead of being sanitized, unlike every other place in the extension that renders the same kind of remote content. Any HTML or script markup in that server-controlled message would run in the context of the Telegram Web page at that point.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itOinkAndStuff - no other listings under this identity
OinkAndStuff - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 6.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Show you desktop notifications
notifications
Add items to the right-click menu
contextMenus
Store an unlimited amount of data in your browser
unlimitedStorage
Store data in your browser
storage
Watch every request your browser makes
webRequest
Watch, block and rewrite every request your browser makes
webRequestBlocking