Is Pacman Game Offline for Google Chrome safe?
We analyzed Pacman Game Offline for Google Chrome version 2.0.0's actual code and gave it a 94/100 trust score. This appears to be a narrowly scoped…
Bottom line
This appears to be a narrowly scoped Pacman game with no meaningful evidence of spying, abuse, or dangerous control.
What it can access
It requests no browser, website, or device access, fitting an extension-owned offline game, though it fetches fixed audio files.[Q1][Q6]
Security weaknesses
No meaningful weakness is shown: remote content is limited to audio, and ordinary websites lack privileged access.[Q7][Q16][Q21]
Signs of misuse
No misuse is shown: it fetches fixed game audio and opens one publisher page after installation without collecting user data.[Q6][Q8][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Defines only the popup, service worker, options page, icons, and descriptive metadata; no permissions or content_scripts fields are present. — manifest.json:5-31
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
The user interface is an extension-owned popup/options page, with no content scripts or host access. — manifest.json:9-26
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Keyboard listeners are attached only to the packaged game page for game controls. — script.js:1084-1089
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores only the game's sound preference in extension-local storage.
Reads and writes the soundDisabled boolean in localStorage. — script.js:815-842
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No device or download permissions are declared. — manifest.json:5-31
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It requests game audio from a fixed GitHub repository and navigates to fixed publisher pages, but no user data is placed into those requests.
Builds fixed audio paths and assigns them to audio elements. — script.js:1060-1080
Initializes the game with https://raw.githubusercontent.com/daleharvey/pacman/master/ as the asset root. — script.js:1273-1281
Opens a fixed publisher welcome URL after first installation and registers a fixed uninstall URL. — update.js:1-24
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The only runtime remote root is a hard-coded path used for game audio assets. — script.js:1273-1281
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On first installation it automatically opens a fixed welcome page on the publisher's site.
The onInstalled handler creates a tab for the fixed installUrl only when the install reason is install. — update.js:1-24
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-setting permissions are declared. — manifest.json:5-31
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Game logic is supplied as readable source. — script.js:1-1283
Loads packaged Modernizr and jQuery libraries before the readable game script. — index.html:19-20
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Packaged jQuery includes its standard globalEval and script-loading machinery. — js/jquery.min.js:2
Packaged Modernizr uses Function to build a static HTML5 compatibility helper. — js/modernizr.min.js:1
All executable scripts loaded by the page are packaged local files. — index.html:19-20
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, webNavigation, host, or content-script permission is declared. — manifest.json:5-31
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Runtime game code handles local audio, canvas state, controls, and game state without telemetry. — script.js:693-1098
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or host permissions are declared. — manifest.json:5-31
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Key handlers are installed only inside the packaged game document after it loads. — script.js:1084-1089
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The sole message handler only replies ok to the fixed runtimeID method and performs no privileged action. — update.js:33-37
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The extension declares no content scripts or scripting permission. — manifest.json:9-26
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No proxy, webRequest, declarativeNetRequest, or downloads permission is declared. — manifest.json:5-31
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:5-31
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote paths are assigned to HTML audio element src attributes. — script.js:700-710
Only fixed audio filenames are appended to the remote asset root. — script.js:1060-1080
Executable JavaScript files are packaged locally. — index.html:19-20
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or content-script bridge is declared. — manifest.json:5-31
The internal message listener only returns ok for runtimeID and has no privileged sink. — update.js:33-37
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The only saved setting toggles game sound. — script.js:815-842
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The recurring loop is the visible Pac-Man game loop. — script.js:775-1098
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No webpage access or content scripts are declared. — manifest.json:5-31