Take Webpage Screenshots
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
FireShot helps you:
• Save receipts, tickets, and order confirmations
• Capture long articles, research, and documentation
• Share design reviews, bug reports, and product ideas
• Keep permanent records of web pages that may change or disappear
🔒 Screenshot is done instantly and stored locally. It never leaves your computer, so it's 100% safe for storing a sensitive information. FireShot can work offline.
🏆 Awarded as "The Best Free Google Chrome Extension (Full Page Screenshot Tool)" by PCMAG.COM
🛑 No spyware and unnecessary permissions - you're just in a couple of clicks away from an ideal screenshot.
Top 7️⃣ reasons to install FireShot:
1️⃣ Save screenshot to disk as PDF (with links), PNG, and JPEG
2️⃣ Capture entire page, visible part of the web page or just a selection
3️⃣ Automatically capture all tabs to PDF or image 🔥 (https://getfireshot.com/demos/capture-all-tabs.php)
4️⃣ Provide a list of URLs for an automatic batch capturing process 🔥 (https://getfireshot.com/demos/capture-website-urls.php)
5️⃣ Attach screenshot to Gmail
6️⃣ Copy screenshot to clipboard
7️⃣ Print
### An upgrade is available. Activate it directly from the menu and:
✓ PDF with direct links and text, can be saved as a single page or split to pages
✓ Capture specific elements, such as scrolling areas on web pages (https://getfireshot.com/selection.php)
✓ Capture all tabs in one click and save to single PDF (https://getfireshot.com/demos/capture-all-tabs.php)
✓ Edit: crop, resize, add text and arrow annotations, blur areas and apply other effects
✓ Send to OneNote (Pro version)
✓ Save captures to disk as PNG, GIF, JPEG, BMP
✓ Upload to Twitter, ImageShack, Flickr, EasyCaptures, custom FTP or HTTP servers
✓ Copy to clipboard
✓ Print
✓ E-Mail
✓ Export captures to external editor
✓ Add page information to screenshot (URL, title, time, domain, etc)
Tags
Privacy Practices
Security Analysis — Take Webpage Screenshots
Permissions
Code Patterns Detected
External Connections
Package Contents 179 files · 39MB
What This Extension Does
The Take Webpage Screenshots extension, also known as FireShot, allows users to capture full webpage screenshots, edit them, and save them to various formats. It's designed for productivity and development purposes, helping users save receipts, tickets, and order confirmations, among other tasks.
Permissions Explained
- storageexpected: This permission allows the extension to store data locally on your device.
Technical: The extension has access to Chrome's storage API, which enables it to save and retrieve data from local storage. This includes storing screenshots, configuration settings, and other user-generated content. - alarmsexpected: This permission allows the extension to schedule tasks or reminders in the background.
Technical: The extension uses Chrome's alarms API to schedule tasks, such as uploading screenshots or sending notifications. This can be used for legitimate purposes like reminding users about uploaded files. - scriptingexpected: This permission allows the extension to execute scripts in the background.
Technical: The extension uses Chrome's scripting API to execute JavaScript code, which enables features like screenshot editing and uploading. This can be used for legitimate purposes like automating tasks or enhancing user experience. - activeTabexpected: This permission allows the extension to access the currently active tab's content.
Technical: The extension uses Chrome's activeTab API to access the current tab's URL, title, and other metadata. This enables features like automatic screenshot capture and editing. - nativeMessagingcheck this: This permission allows the extension to communicate with native applications on your device.
Technical: The extension uses Chrome's nativeMessaging API to communicate with external applications, which can be used for legitimate purposes like integrating with other productivity tools. However, this also introduces a potential attack surface if compromised. ⚠ 1 - contextMenusexpected: This permission allows the extension to create custom context menus in Chrome.
Technical: The extension uses Chrome's contextMenus API to create custom menus, which enables features like screenshot editing and uploading. This can be used for legitimate purposes like enhancing user experience. - tabsexpected: This permission allows the extension to access and manipulate tabs in Chrome.
Technical: The extension uses Chrome's tabs API to access and manipulate tabs, which enables features like automatic screenshot capture and editing. This can be used for legitimate purposes like automating tasks or enhancing user experience. - downloadsexpected: This permission allows the extension to download files from the web.
Technical: The extension uses Chrome's downloads API to download files, which enables features like saving screenshots in various formats. This can be used for legitimate purposes like saving receipts or tickets.
Your Data
The extension accesses data on your device through local storage and the active tab's content. It sends data to various domains, including getfireshot.com, mail.google.com, and auth.getfireshot.com.
Technical Details
Code Findings
This means that the extension loads JavaScript code from an external source, which can potentially introduce security risks if compromised.
Technical: The extension uses a service worker to load external scripts, which enables features like screenshot editing and uploading. However, this also introduces a potential attack surface if compromised.
💡 This pattern is commonly used in legitimate extensions for automating tasks or enhancing user experience.
This means that the extension uses a potentially vulnerable method to assign HTML content, which can be exploited by attackers if not properly sanitized.
Technical: The extension uses innerHTML assignment in certain code paths, which can be used as an XSS vector if not properly sanitized. This is a common pattern in web development, but it requires careful attention to security best practices.
💡 This pattern is commonly used in legitimate extensions for rendering HTML content or editing user input.
This means that the extension creates new script elements at runtime, which can potentially introduce security risks if compromised.
Technical: The extension uses dynamic script creation to load external scripts or execute JavaScript code. This introduces a potential attack surface if compromised.
💡 This pattern is commonly used in legitimate extensions for automating tasks or enhancing user experience.
This means that the extension has access to your keyboard input, which can be used for malicious purposes if compromised.
Technical: The extension uses Chrome's keyboard API to capture keystrokes, which enables features like automatic screenshot editing and uploading. However, this also introduces a significant security risk if compromised.
💡 This pattern is not commonly used in legitimate extensions, as it can be considered an overreach of permissions.
The Take Webpage Screenshots extension has some concerning findings, including the use of nativeMessaging and dynamic script creation. However, these features are also used by legitimate extensions for automating tasks or enhancing user experience. The extension's data exposure is moderate, with access to local storage and active tab content. Users should exercise caution when installing this extension and monitor its behavior closely.
