[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Google Keep Chrome Extension

Version 4.26051.600.1 View in Chrome Web Store

Last scanned: about 18 hours ago

Extension Details

Developer: Google

Rating: 4.0 ★ (8K ratings)

Users: 8,000,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: This extension benefits from extremely strong trust indicators - it's developed by Google themselves, has 8 million users, and maintains a solid 4.0 rating. The official Google authorship provides significant credibility and suggests robust security practices and regular maintenance.

Concerns: Despite the trustworthy developer, the extension requests several powerful permissions that create potential privacy risks. The identity permission allows access to your Google account information, while the tabs permission enables monitoring of your browsing activity across all tabs. The broad host permissions (file://, http://, https://) grant access to virtually all websites you visit, including local files. The combination of identity access and broad web permissions could theoretically allow comprehensive tracking of your online activities tied to your Google account.

Recommendations: Given Google's reputation and the extension's legitimate note-taking functionality, the risk is mitigated compared to unknown developers. However, privacy-conscious users should be aware that Google may collect browsing data through this extension. Consider using Google Keep through the web interface instead if you prefer to limit extension permissions. For users comfortable with Google's data practices, this extension is relatively safe to use given the developer's trustworthiness, but monitor what information you save through Keep as it's tied to your Google account.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

activeTab
identity
identity.email
contextMenus
tabs
unlimitedStorage
scripting

Host Permissions:

file://*/*
http://*/
https://*/

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (86 total):

https://github.com/google/safevalues/issues	https://fonts.gstatic.com/s/i/googlematerialicons/image_not_supported/v12/gm_grey-24dp/1x/gm_image_not_supported_gm_grey_24dp.png
https://www.gstatic.com/keep/backgrounds/grocery_light_thumb_0615.svg	https://www.gstatic.com/keep/backgrounds/food_light_thumb_0615.svg
https://www.gstatic.com/keep/backgrounds/music_light_thumb_0615.svg	https://www.gstatic.com/keep/backgrounds/recipe_light_thumb_0615.svg
https://www.gstatic.com/keep/backgrounds/notes_light_thumb_0615.svg	https://www.gstatic.com/keep/backgrounds/places_light_thumb_0615.svg
https://www.gstatic.com/keep/backgrounds/video_light_thumb_0615.svg	https://www.gstatic.com/keep/backgrounds/celebration_light_thumb_0715.svg
https://www.gstatic.com/keep/backgrounds/travel_light_thumb_0615.svg	https://fonts.gstatic.com/s/i/googlematerialicons/image_not_supported/v12/gm_grey500-24dp/1x/gm_image_not_supported_gm_grey500_24dp.png
https://www.gstatic.com/keep/backgrounds/grocery_dark_thumb_0615.svg	https://www.gstatic.com/keep/backgrounds/food_dark_thumb_0615.svg
https://www.gstatic.com/keep/backgrounds/music_dark_thumb_0615.svg	https://www.gstatic.com/keep/backgrounds/recipe_dark_thumb_0615.svg
https://www.gstatic.com/keep/backgrounds/notes_dark_thumb_0715.svg	https://www.gstatic.com/keep/backgrounds/places_dark_thumb_0615.svg
https://www.gstatic.com/keep/backgrounds/video_dark_thumb_0615.svg	https://www.gstatic.com/keep/backgrounds/celebration_dark_thumb_0715.svg
https://www.gstatic.com/keep/backgrounds/travel_dark_thumb_0615.svg	http://goo.gl/forms/r40gTO4BTb
https://keep.google.com	http://www.w3.org/1999/xhtml
https://ssl.gstatic.com/ui/v1/menu/checkmark.png	https://www.gstatic.com/keep/backgrounds/celebration_light_0714.svg
https://www.gstatic.com/keep/backgrounds/food_light_0609.svg	https://www.gstatic.com/keep/backgrounds/grocery_light_0609.svg
https://www.gstatic.com/keep/backgrounds/music_light_0609.svg	https://www.gstatic.com/keep/backgrounds/notes_light_0609.svg
https://www.gstatic.com/keep/backgrounds/places_light_0609.svg	https://www.gstatic.com/keep/backgrounds/recipe_light_0609.svg
https://www.gstatic.com/keep/backgrounds/travel_light_0614.svg	https://www.gstatic.com/keep/backgrounds/video_light_0609.svg
https://www.googleapis.com/	https://people-pa.googleapis.com/
https://keep-pa.googleapis.com	https://reminders-pa.googleapis.com/
https://taskassist-pa.googleapis.com/	https://chrome.google.com/webstore
https://chromewebstore.google.com/	https://www.google.com/images/cleardot.gif
https://play.google.com/log?format=json&hasfast=true	https://www.googleapis.com/auth/client_channel
https://www.googleapis.com/auth/cclog	https://www.googleapis.com/auth/memento
https://clients2.google.com/service/update2/crx	https://github.com/github/fetch/pull/92#issuecomment-140665932
http://kripken.github.io/emscripten-site/docs/api_reference/preamble.js.html	https://github.com/google/closure-compiler/pull/3913
https://github.com/google/closure-compiler/issues/3193	https://github.com/tc39/proposal-weakrefs
https://github.com/tc39/proposal-explicit-resource-management.	https://github.com/emscripten-core/emscripten/issues/17310
http://en.wikipedia.org/wiki/UTF-8#Description	https://www.ietf.org/rfc/rfc2279.txt
https://tools.ietf.org/html/rfc3629	http://unicode.org/faq/utf_bom.html#utf16-3
http://server.com:4324:12	http://server.com/file.html:4324:12
https://bugzil.la/762556	http://pubs.opengroup.org/onlinepubs/009695399/functions/tzset.html
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/getTimezoneOffset	https://github.com/emscripten-core/emscripten/pull/8236
https://github.com/libsdl-org/SDL/pull/6304	http://www.w3.org/TR/2013/WD-cssom-view-20131217/
https://webkit.org/b/222758	https://github.com/emscripten-core/emscripten/issues/13295.
https://bugzil.la/1328882	https://github.com/emscripten-core/emscripten/pull/1871
https://www.khronos.org/registry/webgl/specs/latest/2.0/#5.15	https://github.com/emscripten-core/emscripten/issues/19300.
https://bugzil.la/1202427	https://github.com/emscripten-core/emscripten/issues/14804
https://github.com/nodejs/node/issues/59617	https://github.com/emscripten-core/emscripten/issues/14130
https://github.com/emscripten-core/emscripten/issues/25076	https://www.gstatic.com/keep/backgrounds/celebration_light_0714_rtl.svg
https://www.gstatic.com/keep/backgrounds/food_light_0609_rtl.svg	https://www.gstatic.com/keep/backgrounds/grocery_light_0609_rtl.svg

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "icon_16.png",
    "48": "icon_48.png",
    "128": "icon_128.png"
  },
  "action": {
    "default_icon": {
      "19": "icon_19.png",
      "38": "icon_38.png"
    },
    "default_title": "Google Keep Chrome Extension"
  },
  "author": {
    "email": "keep-eng@google.com"
  },
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/client_channel",
      "https://www.googleapis.com/auth/cclog",
      "https://www.googleapis.com/auth/memento"
    ],
    "client_id": "192748556389-k5lj2ak6j74mo13ulslbkqkrd8d6b1bh.apps.googleusercontent.com"
  },
  "version": "4.26051.600.1",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "short_name": "__MSG_shortName__",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "activeTab",
    "identity",
    "identity.email",
    "contextMenus",
    "tabs",
    "unlimitedStorage",
    "scripting"
  ],
  "default_locale": "en",
  "offline_enabled": true,
  "host_permissions": [
    "file://*/*",
    "http://*/",
    "https://*/"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "88",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "keep_ba-prod*",
        "index.html",
        "i18n/symbols_*.js"
      ]
    }
  ]
}

by ✦ Astarte

Google Keep Chrome Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (86 total):

Raw Manifest

Detections

Manifest Findings