Google Keep Chrome Extens
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Found a webpage, image, or quote that you want to save for later? With the Google Keep Chrome Extension, easily save the things you care about to Keep and have them synced across all of the platforms that you use — including web, Android, iOS, and Wear. Take notes for additional detail and add labels to quickly categorize your note for later retrieval.
Features:
• Save URLs, text, and images
• Take notes on saved content
• Add labels to your notes
• Automatically saves to Google Keep
Try Google Keep on the web at https://keep.google.com, on your Android device at https://g.co/keep, and on your iOS device at https://itunes.apple.com/us/app/google-keep-your-thoughts/id1029207872.
Tags
Privacy Practices
Security Analysis — Google Keep Chrome Extens
Permissions
Code Patterns Detected
External Connections
Package Contents 208 files · 22.4MB
What This Extension Does
The Google Keep Chrome Extension allows users to save web content, notes, and images directly to their Google Keep account. It's designed for productivity and workflow purposes, suitable for anyone who wants to quickly capture and organize information from the web.
Permissions Explained
- activeTabexpected: This permission allows the extension to access the currently active tab in your browser.
Technical: TheactiveTabpermission grants access to the current tab's URL, title, and content via the Chrome.tabs API. This could potentially allow unauthorized data exfiltration or manipulation if compromised. - identityexpected: This permission allows the extension to access your Google account identity, enabling it to save content directly to your Keep account.
Technical: Theidentitypermission grants access to your Google account credentials via the Chrome.identity API. This could potentially allow unauthorized access to your Google account if compromised. - contextMenusexpected: This permission allows the extension to add custom context menu items in your browser.
Technical: ThecontextMenuspermission grants access to the Chrome.contextMenus API, enabling the creation of custom context menu items. This could potentially allow unauthorized code execution if compromised. - tabsexpected: This permission allows the extension to manage and access your browser tabs.
Technical: Thetabspermission grants access to the Chrome.tabs API, enabling management of tab creation, deletion, and content. This could potentially allow unauthorized data exfiltration or manipulation if compromised. - unlimitedStorageexpected: This permission allows the extension to store an unlimited amount of data in your browser's storage.
Technical: TheunlimitedStoragepermission grants access to the Chrome.storage API, enabling storage of arbitrary amounts of data. This could potentially allow unauthorized data exfiltration or manipulation if compromised. - scriptingexpected: This permission allows the extension to execute scripts in your browser.
Technical: Thescriptingpermission grants access to the Chrome.scripting API, enabling execution of arbitrary scripts. This could potentially allow unauthorized code execution if compromised. - file://*/*check this: This permission allows the extension to access local files on your device.
Technical: Thefile://*/*permission grants access to arbitrary local file paths, enabling potential unauthorized data exfiltration or manipulation if compromised. ⚠ 1 - http://*/check this: This permission allows the extension to make HTTP requests to any domain.
Technical: Thehttp://*/permission grants access to arbitrary HTTP domains, enabling potential unauthorized data exfiltration or manipulation if compromised. ⚠ 1 - https://*/check this: This permission allows the extension to make HTTPS requests to any domain.
Technical: Thehttps://*/permission grants access to arbitrary HTTPS domains, enabling potential unauthorized data exfiltration or manipulation if compromised. ⚠ 1
Your Data
The extension accesses your Google account identity and stores content in your Keep account. It also makes requests to various domains, including Google's own services.
Technical Details
Code Findings
The extension assigns innerHTML to an element, which could potentially allow cross-site scripting (XSS) attacks if compromised.
Technical: The code pattern element.innerHTML = ... is used in the file contentScript.js. This could potentially allow arbitrary script execution if an attacker injects malicious content.
💡 This pattern is commonly used for dynamic content injection in legitimate extensions.
The extension uses String.fromCharCode to obfuscate code, which could potentially make it harder to analyze or debug.
Technical: The code pattern String.fromCharCode(...) is used in the file background.js. This could potentially allow unauthorized code execution if compromised.
💡 This pattern is commonly used for code obfuscation in legitimate extensions.
The extension makes XMLHttpRequests to various domains, which could potentially allow data exfiltration or manipulation if compromised.
Technical: The code pattern XMLHttpRequest is used in the file background.js. This allows the extension to make requests to arbitrary domains.
💡 This pattern is commonly used for legitimate data exchange between extensions and servers.
The extension creates script elements dynamically, which could potentially allow unauthorized code execution if compromised.
Technical: The code pattern document.createElement('script') is used in the file contentScript.js. This allows the extension to inject arbitrary scripts into web pages.
💡 This pattern is commonly used for legitimate script injection in extensions.
The Google Keep Chrome Extension has some concerning permissions and code patterns, but overall it appears to be a legitimate extension that aligns with its stated purpose. However, users should exercise caution when installing any extension, especially those with broad permissions or obfuscated code.
