[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Gmail Settings Extender

Version 4.7 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Rating: 4.5 ★ (60 ratings)

Users: 10,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has a reasonable user base of 10,000 users with a solid 4.5-star rating from 60 reviews, indicating generally positive user experiences. The name "Gmail Settings Extender" clearly describes its purpose and aligns with its requested permissions. However, the lack of visible developer information reduces transparency and accountability.

Concerns:

The extension requests access to Gmail (mail.google.com), which contains highly sensitive personal and potentially business communications, financial information, and private correspondence. The storage permission allows the extension to retain data locally, which could include cached email content or user preferences. While the permissions appear appropriate for a Gmail enhancement tool, the combination of email access and data storage capabilities creates potential privacy risks. The absence of developer contact information makes it difficult to verify the extension's legitimacy or report issues.

Recommendations:

Consider running this extension in a separate Chrome profile dedicated to email management to isolate potential risks from your main browsing profile. Before installation, verify the extension's functionality matches its description by reading recent user reviews. Monitor your Gmail account for any unusual activity after installation. If you handle sensitive business communications, consult your organization's IT policy before installing. Consider alternatives with more transparent developer information if available. Regularly review the extension's permissions and remove it if you notice any suspicious behavior or if it requests additional permissions in future updates.

Findings

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://mail.google.com/. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage

Host Permissions:

https://mail.google.com/

Embedded URLs (140 total):

https://www.gstatic.com/images/icons/material/system_gm/1x/star_border_black_20dp.png	https://www.gstatic.com/images/icons/material/system/1x/file_download_black_20dp.png
https://www.gstatic.com/images/icons/material/system_gm/1x/attachment_black_20dp.png	https://www.gstatic.com/images/icons/material/system_gm/1x/mail_outline_black_20dp.png
https://www.gstatic.com/images/icons/material/system_gm/1x/star_border_white_20dp.png	https://www.gstatic.com/images/icons/material/system_gm/1x/send_white_20dp.png
https://www.gstatic.com/images/icons/material/system_gm/1x/mail_outline_white_20dp.png	https://ssl.gstatic.com/ui/v1/icons/mail/rfr/create_gm_red_24_1x.png
https://www.gstatic.com/images/icons/material/system_gm/1x/expand_more_white_20dp.png	https://github.com/twitter/twemoji
https://twemoji.maxcdn.com/v/13.0.1/72x72/	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	http://www.w3.org/1999/xhtml
https://www.tiny.cloud/tinymce-self-hosted-premium-features/?utm_source=TinyMCE&utm_medium=SPAP&utm_campaign=SPAP&utm_id=editorreferral	https://www.tiny.cloud/powered-by-tiny?utm_campaign=editor_referral&utm_medium=poweredby&utm_source=tinymce&utm_content=v6
https://www.tiny.cloud/docs/tinymce/6/migration-from-5x/	https://www.tiny.cloud/docs/tinymce/6/support/#supportedwebbrowsers
https://en.wikipedia.org/wiki/Base64#URL_applications	https://github.com/beatgammit/base64-js/issues/42
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol#Browser_compatibility	https://github.com/indutny/bn.js/issues/211
https://github.com/keybase/triplesec	https://code.google.com/p/crypto-js/
http://bitwiseshiftleft.github.io/sjcl/doc/symbols/src/core_gcm.js.html	https://github.com/indutny/self-signed/blob/gh-pages/lib/rsa.js
https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
https://github.com/mafintosh/end-of-stream	https://github.com/mafintosh/pump
https://feross.org	https://bugzilla.mozilla.org/show_bug.cgi?id=695438
https://github.com/feross/buffer/pull/97	https://github.com/feross/buffer/pull/148
https://github.com/feross/buffer/issues/154	http://stackoverflow.com/a/22747272/680742
https://github.com/feross/buffer/issues/166	https://github.com/crypto-browserify/crypto-browserify
https://github.com/facebook/react/blob/b5ac963fb791d1298e7f396236383bc955f916c1/src/isomorphic/classic/element/ReactElement.js#L21-L25	https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inforeign
https://dom.spec.whatwg.org/#dom-node-nodetype	https://dom.spec.whatwg.org
http://www.w3.org/TR/DOM-Level-3-Core/glossary.html#dt-document-order	http://dom.spec.whatwg.org/#dom-node-comparedocumentposition
https://developer.mozilla.org/en-US/docs/Web/API/Node/textContent	https://developer.mozilla.org/en-US/docs/Web/API/Node/innerText
http://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#doubling-dbl-1987-m-3	http://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#diffadd-dadd-1987-m-3
https://git.io/vad3K	https://tools.ietf.org/html/draft-josefsson-eddsa-ed25519-03#section-5.2
https://github.com/indutny/elliptic/issues	https://github.com/indutny/elliptic
https://www.ietf.org/rfc/rfc2781.txt	http://www.ietf.org/rfc/rfc2781.txt
http://www.iana.org/assignments/charset-reg/UTF-32	http://www.unicode.org/reports/tr19/tr19-9.html
https://github.com/mathiasbynens/he/blob/master/src/he.js#L94-L119	http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
https://github.com/lodash/lodash/blob/4.17.15/dist/lodash.js#L6735-L6744	https://github.com/ljharb/object.assign/issues/17
https://github.com/WebReflection/get-own-property-symbols/issues/4	https://github.com/google/closure-library/blob/8598d87242af59aac233270742c8984e2b2bdbe0/closure/goog/crypt/crypt.js#L117-L143
https://github.com/google/closure-library/blob/master/LICENSE	https://mths.be/he
https://html.spec.whatwg.org/multipage/syntax.html#table-charref-overrides	https://html.spec.whatwg.org/multipage/syntax.html#table-charref-overrides.
https://mathiasbynens.be/notes/ambiguous-ampersands:	http://html5sec.org/#102
http://html5sec.org/#108	http://html5sec.org/#133.
https://mths.be/punycode.	https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
https://mths.be/notes/ambiguous-ampersands	https://github.com/mathiasbynens/he
http://asdf.com	http://asdf.com/dir/subdir
https://github.com/fb55/htmlparser2	https://www.w3.org/TR/REC-xml/#NT-NameStartChar

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhuTu/SkC+MaUwG18UtiOtfUIA0mF+wfWp27v1RZrL+O/99uynM6YVdnv7b4fSjm42wYnHC0n6wHUbIOWl3vLcJtGtH55NKT5bEq+/gwF367MiQpVeFLMu8E1NJ4O20/yqIKe6StSIMZM77yTomWaIC5J1Bhjo0Z2Al1+KIj0qQ5vQS70x0lrt1FYpymx9AjBU8s8CNPJ3LX/gTR0+0sYzuZn9LsgyjSs/peTF8EdaPblYMDKUBBbvhiqh7DnSDAw/IIxGAQSta9b/NN488dwJ0ROx331wDLp6ephtNnF/b4bBUbE8ZsSsPsYEl7Msy4x9gwQGUSgjQtdL+TuiW3jRQIDAQAB",
  "name": "Gmail Settings Extender",
  "icons": {
    "16": "icons/icon16.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_popup": "options/options.html",
    "default_title": "Extension Options"
  },
  "version": "4.7",
  "background": {
    "service_worker": "scripts/background.js"
  },
  "options_ui": {
    "page": "options/options.html",
    "open_in_tab": false
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Bookmark mails and start compose in chrome-like tabs, add custom rich-text editor, auto add CC/BCC, reverse conversations and more..",
  "permissions": [
    "storage"
  ],
  "content_scripts": [
    {
      "js": [
        "scripts/extensionInjector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://mail.google.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://mail.google.com/"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "*://mail.google.com/*"
      ],
      "resources": [
        "scripts/*",
        "css/style.css",
        "options/SignatureExample.png",
        "plugins/tinymce/*"
      ]
    }
  ]
}

by ✦ Astarte

Gmail Settings Extender

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (140 total):

Raw Manifest

Detections

Manifest Findings