Is Access Database Viewer — Open MDB & ACCDB Files safe?
We analyzed Access Database Viewer — Open MDB & ACCDB Files version 1.1.1's actual code and gave it a 86/100 trust score. This appears to be a…
Bottom line
This appears to be a purpose-aligned local database viewer with limited access and no established abuse, but exported data should still be handled carefully.
What it can access
It has no website or browser-data permissions, but it can read user-selected databases that may contain sensitive records and save requested exports [Q1][Q3][Q5].
Security weaknesses
The large bundled database component makes full review harder, and CSV exports retain formula-like leading characters that could be risky when opened in spreadsheet software [Q10][Q20].
Signs of misuse
There is no established evidence of outside data sharing, remote code, tracking, or website control; its only automatic action is opening its own viewer after installation [Q6][Q7][Q8][Q16].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Declares no permissions, host_permissions, content_scripts, or web_accessible_resources. — manifest.json:4-16
Opens only viewer.html on toolbar click and viewer.html?welcome=1 after first installation. — bg.js:1-16
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no website matches or host access. — manifest.json:4-16
Escapes database filenames, table names, column names, relationship text, search results, and cell values before rendering HTML. — viewer.js:255-265,316-380,407-427,663-665
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
A selected database can contain sensitive business or personal records, and the viewer reads its tables and values. Access is explicit and local: the user chooses the file, and no form or webpage input monitoring exists.
Provides an explicit local file picker and drop target for Access databases. — viewer.html:17-18,47-50
Reads the chosen file, requests table rows from the worker, and displays or searches them. — viewer.js:214-235,267-295,421-488
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests none of the browser-data permissions. — manifest.json:4-16
Uses extension-page localStorage for rating state and the locally validated Pro record. — viewer.js:147-168,700
Reads, writes, and clears only the al.pro activation record. — gate.js:631-656
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads a database file explicitly selected or dropped by the user and can save requested converted files. It has no general file-system, clipboard, location, camera, microphone, or native-application access.
Limits file selection to the viewer's explicit picker or drop target. — viewer.html:17-18,47-50
Reads the selected file and creates local export downloads after a user action. — viewer.js:214-235,587-640,672-684,737-745
Declares no device or native-integration permissions. — manifest.json:4-16
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Sets connect-src 'self' and blocks form submissions with form-action 'none'. — manifest.json:9-10
Defines the bundled SQL loader's network function to throw 'network access is disabled by design'. — worker.js:10934-10940
Embeds the SQLite WebAssembly payload and passes it directly to the packaged engine. — worker.js:23320,24743
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Restricts scripts and connections to packaged extension resources. — manifest.json:9-10
Validates licenses through the packaged gate without a server call. — license.js:1-12,29-45
Contains and initializes the packaged SQLite WebAssembly bytes. — worker.js:23320,24743
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically opens its packaged viewer once after installation. All file reading, searching, exports, checkout navigation, and review-page navigation require a clear user action.
Opens viewer.html?welcome=1 only on the install event. — bg.js:7-16
Ties exports and external checkout or review tabs to button clicks. — viewer.js:165-168,607-640,672-699
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting or extension-management permissions. — manifest.json:4-16
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The large worker bundles database, compression, XML, and SQLite libraries, including embedded WebAssembly, which makes full review difficult. The application-specific viewer, export, worker-dispatch, licensing, and security-boundary code remains readable; deliberate concealment was not demonstrated.
Contains a roughly 1.7 MB generated bundle with parser libraries and embedded WebAssembly. — worker.js:1-24884
Keeps the export routines and operation dispatcher readable near the end of the bundle. — worker.js:24080-24863
Contains readable UI, escaping, file-selection, and export-control logic. — viewer.js:1-758
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
A packaged bind compatibility helper creates a wrapper function from a generated argument list. — worker.js:5984
A packaged intrinsic-detection helper constructs a function from an internal expression string. — worker.js:6154
Allows packaged WebAssembly but does not allow unsafe-eval for extension-page scripts. — manifest.json:9-10
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares no website, tabs, webNavigation, or history access. — manifest.json:4-16
Uses a local mailto error report and local rating state, not passive page tracking. — viewer.js:117-168
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Documents and invokes local license validation without a provider call. — license.js:1-12,29-45
Normalizes and hashes the entered key locally, then checks it against the packaged hash set. — gate.js:42-65,612-629
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookie, website, or session-related access. — manifest.json:4-16
Passes an entered database password only to the local worker and keeps it in viewer memory for worker recovery. — viewer.js:23-33,84-115,171-195
Blocks external connections from the viewer and worker. — manifest.json:9-10
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Contains the extension's own search and database-password inputs. — viewer.html:59-64,100-104
Reads those viewer inputs only on the corresponding button or Enter action. — viewer.js:179-189,668-670,703-706
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, externally_connectable origins, or web-accessible resources. — manifest.json:4-16
Creates a packaged worker and uses a private request-ID map for viewer-to-worker operations. — viewer.js:7-44
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Has no webpage injection capability. — manifest.json:4-16
Escapes all reviewed database-derived values placed into viewer HTML. — viewer.js:255-265,316-380,407-427,663-665
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It creates CSV, ZIP, Excel, SQLite, or SQL downloads after the user clicks an export option. It does not redirect traffic, rewrite headers, intercept downloads, or change proxy settings.
Builds local Blob URLs and starts only the export selected by the user. — viewer.js:581-640,680-684
Declares no downloads, proxy, webRequest, or declarativeNetRequest permissions. — manifest.json:4-16
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission or localhost host access. — manifest.json:4-16
The packaged worker disables its library network loader rather than contacting a local or remote service. — worker.js:10934-10940
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Formats database values and escapes CSV delimiters, quotes, and newlines, but leaves leading =, +, -, and @ characters intact. — worker.js:24122-24146
Exports the resulting CSV or ZIP only after the user chooses that action. — viewer.js:607-623
Encodes strings in generated XLSX files as inlineStr cells rather than formula cells. — worker.js:24218-24252
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, exposed resources, host access, or externally_connectable sites. — manifest.json:4-16
The only application message path is internal to viewer.html and its packaged worker. — viewer.js:7-44
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Calculates feature gating from local table and row counts and validates keys against a packaged set. — gate.js:571-629
Contains no remote activation or feature-control path. — license.js:1-12,29-45
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Dispatches only database open, page, search, conversion, export, and cancellation operations. — worker.js:24738-24863
The service worker only opens the packaged viewer. — bg.js:1-16
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Blocks form submissions and has no webpage access. — manifest.json:9-10
The search, password, and license inputs belong only to the packaged viewer. — viewer.html:59-64,100-120
Handles those viewer inputs locally without changing form actions or submitting them to a server. — viewer.js:668-706