NotebookLM - WebSync Full Site Importer
Version 1.9.3.26273 View in Chrome Web Store
Extension Details
Context-Aware Verdict
The extension has a solid user base of 80,000 users and maintains a good 4.5-star rating, suggesting positive user experiences. The specific focus on NotebookLM integration indicates a legitimate use case for Google's AI note-taking service. However, the relatively low number of reviews (38) compared to the user count raises some questions about user engagement or review authenticity.
The primary concern is the broad host permissions that allow access to both the developer's domain and Google's NotebookLM service. While the activeTab and storage permissions are reasonable for a web content importer, the combination creates potential for data collection across websites. The extension can access any active tab content when triggered, which could include sensitive information from various websites. The access to NotebookLM.google.com is expected given the extension's purpose, but this creates a pathway for potentially sensitive research data.
Consider using this extension in a dedicated Chrome profile separate from your main browsing, especially if you work with confidential information. Before using, verify that the developer's website (websync-for-notebooklm.com) is legitimate and review their privacy policy. Only activate the extension when specifically needed for importing content to NotebookLM. Monitor what data gets imported and ensure you're comfortable with the content being processed through both the extension and Google's services.
Findings
Security Analysis Details
Required Permissions:
- activeTab
- scripting
- storage
Optional Permissions:
- notifications
- offscreen
- tabs
- contextMenus
Host Permissions:
- https://websync-for-notebooklm.com/*
- https://notebooklm.google.com/*
Embedded URLs (193 total):
| https://websync-for-notebooklm.com | http://www.w3.org/1998/Math/MathML | |
| https://www.youtube.com/embed/ | https://news.ycombinator.com/ | |
| https://news.ycombinator.com/item?id= | http://www.w3.org/2000/svg | |
| https://reddit.com | https://staging.websync-for-notebooklm.com/extensionSigninHelper.html | |
| https://websync-for-notebooklm.com/extensionSigninHelper.html | https://react.dev/errors/ | |
| http://www.w3.org/1999/xlink | http://www.w3.org/XML/1998/namespace | |
| https://tally.so/r/nGYE42 | https://tally.so/r/3j5VN9 | |
| https://tally.so/r/nGkYRL? | https://youtu.be/mReOoe8Ou | |
| https://example.com/docs?ref=nav | https://notebooklm.google.com/ | |
| https://notebooklm.google.com/notebook/ | https://clients2.google.com/service/update2/crx | |
| https://websync-for-notebooklm.com/ | http://www.apache.org/licenses/LICENSE-2.0 | |
| https://firebaseinstallations.googleapis.com/v1 | https://fcmregistrations.googleapis.com/v1 | |
| http://www.w3.org/1999/xhtml | http://www.w3.org/2000/xmlns/ | |
| http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd | https://docs.googleapis.com/v1/documents | |
| https://docs.google.com/document/d/ | https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md | |
| https://www.youtube.com/watch?v= | https://esbench.com/bench/5bfee68a4cd7e6009ef61d23 | |
| https://github.com/garycourt/murmurhash-js | https://github.com/aappleby/smhasher/blob/61a0530f28277f2e850bfc39600ce61d02b518de/src/MurmurHash2.cpp#L37-L86 | |
| https://esbench.com/bench/5b809c2cf2949800a0f61fb5 | https://github.com/emotion-js/emotion/issues/2675 | |
| https://floating-ui.com/docs/virtual-elements | https://floating-ui.com/docs/detectOverflow | |
| https://floating-ui.com/docs/arrow | https://floating-ui.com/docs/autoPlacement | |
| https://floating-ui.com/docs/flip | https://github.com/floating-ui/floating-ui/issues/2549#issuecomment-1719601643 | |
| https://floating-ui.com/docs/hide | https://floating-ui.com/docs/inline | |
| https://floating-ui.com/docs/offset | https://floating-ui.com/docs/shift | |
| https://floating-ui.com/docs/size | https://github.com/floating-ui/floating-ui/issues/2317 | |
| https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block | https://drafts.csswg.org/css-transforms-2/#individual-transforms | |
| https://samthor.au/2021/observing-dom/ | https://floating-ui.com/docs/autoUpdate | |
| https://github.com/floating-ui/floating-ui/issues/1740 | https://bugs.webkit.org/show_bug.cgi?id=215438. | |
| https://tc39.es/ecma402/#sec-setnfdigitoptions | https://www.unicode.org/cldr/charts/43/supplemental/language_plural_rules.html#comparison | |
| https://github.com/adobe/react-spectrum/pull/5134/files#r1337037855 | https://github.com/rafgraph/detect-it/blob/main/src/index.ts#L19-L36 | |
| https://www.w3.org/TR/uievents/#determine-keydown-keyup-keyCode | https://www.google-analytics.com/mp/collect | |
| https://github.com/rollup/rollup/issues/1691 | https://snyk.io/vuln/SNYK-JS-LODASH-450202 | |
| https://github.com/firebase/firebase-js-sdk/issues/6838 | https://securetoken.google.com/ | |
| https://firebase.google.com/docs/studio/preview-apps#preview-backend | https://github.com/iliakan/detect-node/ | |
| https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error#Custom_Error_Types | https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work | |
| https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-2.html#support-for-newtarget | http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf. | |
| https://bugs.webkit.org/show_bug.cgi?id=109036 | http://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3 | |
| https://github.com/google/closure-library/blob/master/closure/goog/math/exponentialbackoff.js. | https://github.com/microsoft/TypeScript-DOM-lib-generator/pull/1405 | |
| https://github.com/grpc/grpc/blob/bceec94ea4fc5f0085d81235d8e1c06798dc341a/include/grpc%2B%2B/impl/codegen/status_code_enum.h | https://github.com/google/protobuf/blob/master/src/google/protobuf/timestamp.proto | |
| https://developer.microsoft.com/en-us/microsoft-edge/platform/status/indexeddbarraysandmultientrysupport/ | https://github.com/axemclion/IndexedDBShim | |
| https://bugs.webkit.org/show_bug.cgi?id=197050 | https://stackoverflow.com/q/56496296/110915 |
Raw Manifest
{ "name": "NotebookLM - WebSync Full Site Importer", "icons": { "16": "icon16.png", "32": "icon32.png", "48": "icon48.png", "128": "icon128.png" }, "action": { "default_popup": "index.html" }, "version": "1.9.3.26273", "commands": { "import": { "description": "Import current page to Notebook", "suggested_key": { "default": "Alt+I" } }, "open-notebook": { "description": "Open Notebook", "suggested_key": { "default": "Alt+O" } } }, "background": { "type": "module", "service_worker": "serviceWorker.js" }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "Import web pages, websites, or YouTube playlists to NotebookLM – including login-protected or dynamic sites. Easy One-click Imports", "permissions": [ "activeTab", "scripting", "storage" ], "version_name": "1.9.3.26273", "host_permissions": [ "https://websync-for-notebooklm.com/*", "https://notebooklm.google.com/*" ], "manifest_version": 3, "optional_permissions": [ "notifications", "offscreen", "tabs", "contextMenus" ], "optional_host_permissions": [ "http://*/*", "https://*/*", "file:///*" ] }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.