Screenshot extensions reviewed: the permissions they really need, the ShotBird hijack & safer alternatives

Screenshot extensions are one of those categories everyone has and nobody thinks about. You install one to capture a full-page scroll or annotate a bug report, and then it just sits in your toolbar for three years. The problem is that a screenshot tool, by definition, has to be able to see everything on the page you're capturing — and a lot of them ask for far more reach than that single job requires.

I want to walk through what these extensions actually do under the hood, where the real risk lives, and how to capture your screen without handing a random developer a window into every site you visit.

TL;DR — the quick verdict

• A screenshot tool only genuinely needs to act on the page you're currently looking at — capturing "all your data on all websites" is a much bigger ask than the feature requires.
• The category has already been weaponized: the ShotBird extension, a Featured screenshot utility, was turned into two-stage malware after an ownership transfer in early 2026.
• Full-page capture needs scripting access to the page, and "save to disk" needs the downloads permission — both are legitimate, but both also make a malicious update far more dangerous.
• Your browser's built-in capture and your OS screenshot tool do 90% of what these extensions do, with zero permissions.
• If you keep one installed, check its permissions and developer identity now — not after it changes hands.

What a screenshot extension actually does

At its simplest, a screenshot extension adds a button that captures the visible browser tab as an image. Chrome and Firefox both expose an API for exactly this (captureVisibleTab), and that single capability is enough for the basic "grab what I'm looking at" use case.

The popular ones go further. Full-page capture — the feature that stitches together a long scrolling page into one tall image — needs to inject a script into the page to measure its height, scroll it programmatically, and capture each segment. Annotation tools draw an overlay on top of the page. "Save as PDF" and "download to disk" features need the downloads permission.

None of this is inherently sinister; it's just that each added feature widens the permission footprint, and a wider footprint is worth more to an attacker if the extension is ever compromised.

That's the honest tension with this category. The features people actually want — full-page capture, annotation, one-click save — are also the features that justify broad access. So you can't just say "screenshot extensions are bad." You have to look at the specific permission set and ask whether it matches the feature set.

Security analysis: where the risk actually lives

The dangerous combination is broad host access plus scripting plus a remote update channel. A screenshot extension that requests access to every site (<all_urls>) can read and modify the content of any page you open, not just the one you're capturing. I broke down exactly what that grant means in my earlier piece on the all-URLs host permission — the short version is that it's the single most powerful thing you can hand an extension.

Now layer on the supply-chain angle. An extension can ship with completely clean, legitimate permissions, behave perfectly for years, and then turn malicious through an update — most commonly after the original developer sells it. That's not theoretical for this category.

According to a report from The Hacker News, corroborated by independent researcher MonX Research, the ShotBird Chrome extension — a Featured screenshot utility with roughly 800 users — was converted into a multi-stage malware platform after its ownership was transferred to a new operator in February 2026. The researchers describe a two-stage chain: first a browser-level remote code execution delivered via the extension's command-and-control server, then a pivot to the host machine through a PowerShell-based stager that harvested credentials. The extension was pulled from the store after disclosure in March 2026.

What makes ShotBird a clean illustration of the category risk is that nothing about its permissions had to change. The same access that let it screenshot pages let the new owner push weaponized code to every existing user through the normal auto-update channel. I've written before about how ownership transfers quietly weaponize trusted extensions — screenshot tools are simply an attractive target because the permissions they legitimately hold are already powerful.

Privacy score breakdown: what to check before you trust one

You don't need a security degree to triage a screenshot extension. You need to compare what it requests against what the feature actually requires. Here's the rough map I use:

Permission	Legitimate for screenshots?	What it means
activeTab	✓ Ideal	Acts only on the tab you click it on
<all_urls> host access	⚠ Only for auto-injected full-page capture	Can read/modify every site you visit
scripting / content scripts	✓ Needed for full-page + annotation	Injects code into pages
downloads	✓ Needed for save-to-disk	Writes files to your machine
tabs	⚠ Sometimes	Reads tab URLs and titles across windows
Remote config / external server	✗ Rarely justified	Lets the developer change behavior post-install
clipboardWrite	✓ Reasonable (copy image)	Writes to clipboard
cookies / webRequest	✗ No screenshot reason	Major red flag

The cleanest screenshot extensions lean on activeTab, which only grants access to a page when you actively click the extension. That model means the tool can't silently watch your browsing — it only sees the page when you ask it to capture. If a screenshot extension instead demands permanent access to all sites and you mostly capture the visible tab, that's a mismatch worth questioning.

Two more checks take about a minute each. First, open the extension's "Privacy practices" tab on its store listing — a screenshot tool declaring that it collects "browsing activity" or "personal communications" is describing behavior that has nothing to do with capturing images. Second, look at the developer: an established identity with a real website and other published work is a much safer bet than an anonymous account with one extension and broad permissions. You can pull up the permission profile for any extension on Extenshi's catalog and see the access it requests laid out plainly before you commit.

Are the popular screenshot extensions safe?

Mostly, the well-known screenshot tools are legitimate businesses, not malware. GoFullPage is a good example of the healthy version of this category — according to ExtensionPay's 2026 revenue analysis, it earns roughly $10,000/month from around 4 million users on a $1/month freemium tier. That matters because a developer with a real, sustainable revenue model has far less incentive to sell out to a data broker or a malware operator than an anonymous free tool with no business behind it.

But "currently safe" and "safe forever" aren't the same thing, and that's the whole lesson of the ShotBird case. A clean extension today can change hands tomorrow. So even with a reputable tool, the right move is to keep the permission footprint minimal and re-check after any update that asks for new access.

Safer alternatives: capture without the permission tax

For most people, the safest screenshot tool is the one that needs no extension permissions at all.

Your browser's built-in capture. Chrome can screenshot a full page from DevTools (open DevTools, run the "Capture full size screenshot" command), and Firefox has a native screenshot tool built right into the page context menu — full-page capture included, no add-on required. Zero permissions, zero third-party code.

Your operating system's screenshot tool. macOS (Shift-Cmd-4 / 5) and Windows (Snipping Tool, Win-Shift-S) both capture, annotate, and save without touching your browser at all. For the everyday "grab this region and mark it up" task, this is genuinely all most people need.

A single, reputable extension with activeTab scope — if you truly need integrated full-page capture as part of a workflow. Pick one from a developer with a verifiable identity and a stated privacy policy, prefer the one requesting the narrowest permissions, and avoid anything asking for all-site access it can't justify.

Final recommendation

Screenshot extensions aren't a category to fear, but they are a category to keep on a short leash. The feature is genuinely useful, and most of the popular tools are run by legitimate developers. The risk isn't that screenshotting is dangerous — it's that the access these tools hold is powerful enough to be valuable to whoever controls the extension next.

So do the boring thing: open chrome://extensions/ or about:addons, find your screenshot tool, and look at what it can access. If it's sitting on all-site access for a feature you never use, swap it for activeTab-scoped tool or your browser's built-in capture. And if you can do the job with the native OS shortcut, you've removed the risk entirely.

Before you install the next one, take 30 seconds to check its permissions and developer on Extenshi's catalog.

See security report →

---

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].

Sources: The Hacker News — Chrome Extension Turns Malicious After Ownership Transfer (corroborated by MonX Research); ExtensionPay — Chrome Extensions with Impressive Revenue (2026).