[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Web Text Expander: Text Shortcuts & Snippets

Version 2026.10.15.0 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Developer: Kapitis, MB

Rating: 4.6 ★ (150 ratings)

Users: 30,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 7 total findings, including 4 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
unlimitedStorage
clipboardRead
clipboardWrite
offscreen
scripting
alarms
contextMenus

Optional Permissions:

downloads

Host Permissions:

*://*/*

Embedded URLs (92 total):

https://webtextexpander.com/api/team-shortcuts	https://webtextexpander.com/changelog.html
https://webtextexpander.com/api/extension-events	https://webtextexpander.com/uninstall.php?extensionId=
https://webtextexpander.com/check_subscription.php?extensionId=	https://webtextexpander.com/welcome.html
https://webtextexpander.com/welcome_ff.html	https://webtextexpander.com/check.php?extensionId=
https://webtextexpander.com/register.php	https://webtextexpander.com/review.php
https://webtextexpander.com/log_store_open.php	https://webtextexpander.com/log_usage.php
https://webtextexpander.com/back_to_school.html	https://webtextexpander.com/halloween.html
https://webtextexpander.com/cyber_week.html	https://webtextexpander.com/spring.html
https://webtextexpander.com	http://www.w3.org/1999/xhtml
http://www.w3.org/2000/svg	https://webtextexpander.com/privacy.html
https://webtextexpander.com/terms.html	https://clients2.google.com/service/update2/crx
https://webtextexpander.com/teams.html	https://www.youtube.com/watch?v=NwvMYlDU2NU
https://www.youtube.com/watch?v=LhTmkX5VmiY	https://youtu.be/EN7IRIa6T3A
https://webtextexpander.com/blog/shortcuts.html	https://www.youtube.com/watch?v=r9x7KG7U72s
https://www.youtube.com/watch?v=UUVGsFt90Z8	https://feross.org/opensource
https://buy.stripe.com/test_dR66oK8Oy3b52KA288?prefilled_email=	https://buy.stripe.com/cN2eXK88Z4Hv0dG145?prefilled_email=
https://buy.stripe.com/3csaHuexn2zngcEeUX?prefilled_email=	https://webtextexpander.com/api/currency?extensionId=
https://addons.mozilla.org/firefox/addon/web-text-expander/	https://chromewebstore.google.com/detail/web-text-expander-text-sh/cmdcnfnhdcaoklhdlmdjfaoandbdcklh/reviews
http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero	http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring
http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types	http://ecma-international.org/ecma-262/7.0/#sec-patterns
http://ecma-international.org/ecma-262/7.0/#sec-tolength	http://ecma-international.org/ecma-262/7.0/#sec-object.keys
http://www.ecma-international.org/ecma-262/7.0/#sec-regexp.prototype.tostring	https://lodash.com/docs#escape
https://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#push-down-values	https://github.com/w3c/csswg-drafts/issues/2514.
https://bugs.webkit.org/show_bug.cgi?id=31902	https://www.w3.org/TR/cssom-view-1/#element-scrolling-members
https://github.com/microsoft/TypeScript/issues/22609	https://html.spec.whatwg.org/multipage/syntax.html#element-restrictions
https://www.iana.org/assignments/media-types/text/uri-list	https://quilljs.com
https://en.wikipedia.org/wiki/Whitespace_character	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Character_Classes#Types
https://buy.stripe.com/7sY6oHcMLcwi1nv6jlak009	https://buy.stripe.com/28EaEXdQPfIu2rz8rtak00a
https://addons.mozilla.org/firefox/addon/tabatrium-bookmark-manager/	https://chromewebstore.google.com/detail/jnfhnhiapdacaohbmhmeflphndbabaag
http://code.google.com/p/google-diff-match-patch/	http://www.apache.org/licenses/LICENSE-2.0
http://neil.fraser.name/news/2007/10/09/	http://neil.fraser.name/news/2010/11/04/
http://mozilla.org/MPL/2.0/.	https://github.com/mozilla/webextension-polyfill/issues/130
https://billing.stripe.com/p/login/00g3en3NWeZN9xKaEE?prefilled_email=jenny%40example.com	https://billing.stripe.com/p/login/test_9AQcOd9Jc4EZ7Zu288
https://lodash.com/	https://jquery.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
https://en.wikipedia.org/wiki/Base64#URL_applications	https://github.com/beatgammit/base64-js/issues/42
https://js.foundation/	https://feross.org
https://bugzilla.mozilla.org/show_bug.cgi?id=695438	https://github.com/feross/buffer/pull/148
https://github.com/feross/buffer/issues/154	http://stackoverflow.com/a/22747272/680742
https://github.com/feross/buffer/issues/166	https://github.com/feross/buffer/issues/219

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "48": "icons/icon48.png",
    "96": "icons/icon96.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon16.png",
      "32": "icons/icon32.png"
    },
    "default_popup": "popup.html"
  },
  "version": "2026.10.15.0",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "options.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "storage",
    "unlimitedStorage",
    "clipboardRead",
    "clipboardWrite",
    "offscreen",
    "scripting",
    "alarms",
    "contextMenus"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content_script.js"
      ],
      "css": [
        "content_style.css"
      ],
      "matches": [
        "*://*/*"
      ],
      "all_frames": true,
      "exclude_matches": [
        "https://docs.google.com/document/*"
      ],
      "match_origin_as_fallback": true
    },
    {
      "js": [
        "gdocs_enable_annotated_canvas.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "*://docs.google.com/document/*"
      ]
    },
    {
      "js": [
        "gdocs_content_script.js"
      ],
      "css": [
        "content_style.css"
      ],
      "run_at": "document_end",
      "matches": [
        "*://docs.google.com/document/*"
      ]
    }
  ],
  "host_permissions": [
    "*://*/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "downloads"
  ],
  "externally_connectable": {
    "matches": [
      "https://webtextexpander.com/*"
    ]
  },
  "minimum_chrome_version": "109"
}

by ✦ Astarte

Web Text Expander: Text Shortcuts & Snippets

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (92 total):

Raw Manifest

Detections

Manifest Findings