Is SAP Sales Cloud for Gmail safe?
We analyzed SAP Sales Cloud for Gmail version 2608.0.0.135's actual code and gave it a 58/100 trust score. This is a purpose-aligned CRM extension with…
Bottom line
This is a purpose-aligned CRM extension with sensitive access and a serious page-message security weakness.
What it can access
It can read sensitive Gmail and Calendar content and handle identity material for its CRM service, which fits the advertised feature but creates substantial privacy exposure. [Q3][Q6][Q14]
Security weaknesses
A page message bridge lets an allowed webpage request mailbox, settings, and identity functions without confirming which page component sent the request. [Q21]
Signs of misuse
It sends email and calendar information and handles identity material for its CRM service, but no unrelated collection or deceptive misuse was established. [Q6][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs at document start on Gmail, Google Calendar and specified SAP cloud domains. website access are narrower—Gmail and Calendar only—and remote extension-page connections are CSP allowlisted.
Lists the content-script sites, Gmail/Calendar host permissions, web-accessible resources and strict extension-page CSP. — manifest.json:24-43,49-68
Which websites can it run on, and can it read or change what appears on those pages?
The packaged page integration reads Gmail message/thread structures, compose windows and Calendar event fields. This is central to its advertised CRM feature.
Parses Gmail XHR data and DOM structures into email/thread records and reads Calendar title, description, location, attendee and time fields. — scripts/chrome.bundle.js:2,18
Automatically loads the bridge on Gmail and Calendar. — manifest.json:24-37
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can access sensitive email bodies, recipients, senders, attachments and calendar-event details. Password, payment-card and login-form capture were not found.
Email parsers build records containing body, subject, sender, recipients and attachment metadata; Calendar integration reads event fields. — scripts/chrome.bundle.js:2,18
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It observes Gmail network responses and the active Gmail/Calendar tab to maintain CRM context. It does not request Chrome history, bookmarks, cookies or downloads databases.
Patches Gmail's page-world XMLHttpRequest to parse message and thread responses. — scripts/chrome.bundle.js:2
Queries the active tab URL for popup status and iterates open Gmail/Calendar tabs for refresh notifications. — scripts/background.js:1
Requests alarms and storage only, with Gmail/Calendar host access. — manifest.json:45-51
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares only alarms, storage and Gmail/Calendar host permissions. — manifest.json:45-51
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Selected email/calendar content and identity context are sent to the configured CRM sidebar. Destinations are restricted to the related Invisible CRM service; no unrelated third party was found.
setContent sends selection, item data, user email, display name, tenant and roaming settings to the remote sidebar message channel. — scripts/chrome.bundle.js:18
CSP restricts frame-src and connect-src to *.c4c.invisiblesolutions.com and *.c4cdev.invisiblecrm.com. — manifest.json:42-43
Uses constructed tenant endpoints for version, instrumentation and settings requests. — scripts/background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The configured service supplies version markers, tenant settings and instrumentation keys. These affect integration state and diagnostics but do not supply executable code.
Calls /login/checkVersionUpdated and /settings/GetInstrumentationKey, then stores returned markers and connection settings. — scripts/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The content bridge and Gmail XHR observers start automatically. CRM data exchange begins after tenant configuration and sidebar initialization, rather than requiring a separate confirmation for each selected message.
Injects contentscript.js at document_start on supported sites. — manifest.json:24-36
Loads the packaged page bundle and opens the background message channel automatically. — scripts/contentscript.js:1
Initializes observers and sends set_content as mailbox selection changes. — scripts/chrome.bundle.js:2,18
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings, proxy, privacy or management permission. — manifest.json:45-51
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Application scripts are bundled and minified, making review harder, but behavior, message names, destinations and controls remain directly inspectable. No encrypted data was found.
Large bundled page application retains readable strings and structured method names. — scripts/chrome.bundle.js:1-19
Single-line bundled worker exposes its full endpoint and action logic. — scripts/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains bundled library evaluation capabilities but packaged integration loads only scripts from chrome.runtime.getURL under self-only script CSP. — scripts/chrome.bundle.js:2,18
Extension-page script-src is restricted to self and object-src is none. — manifest.json:42-43
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Queries active and open tabs but filters operational broadcasts to Gmail/Calendar URLs. — scripts/background.js:1
Uses location paths to identify Gmail/Calendar account and event context. — scripts/chrome.bundle.js:18
Does it create a persistent ID or browser fingerprint to recognize you?
The service returns an instrumentation key or connection string and the bundle contains event/exception telemetry. No advertising ID or cross-service behavioral profile was found.
Fetches and stores Key and ConnectionString from GetInstrumentationKey; logging interfaces support trackEvent and trackException. — scripts/background.js:1
Contains trace and exception telemetry calls for integration diagnostics. — scripts/chrome.bundle.js:2,18
Does it send cookies, session details, authentication data, or page contents elsewhere?
The remote integration can set, retrieve and remove per-email identity tokens, which the worker stores in Chrome sync storage. This is intended authentication handling but exposes valuable session material to the bridge.
proxy_setIdentityToken, proxy_getIdentityToken and proxy_removeIdentityToken forward token operations from the CRM UI. — scripts/chrome.bundle.js:18
Stores token markers keyed by normalized email in chrome.storage.sync and returns them to the connected content bridge. — scripts/background.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It observes compose recipients, message content and Calendar form-like fields so the CRM can read and update them. No keystroke logger, screenshot capture or clipboard monitoring was found.
View implementations expose selected message/calendar data and remote-call handlers for compose operations. — scripts/chrome.bundle.js:18
Can a website or remote server send commands that make the extension take actions?
The allowlisted vendor sidebar can send packaged protocol commands that read mailbox context and alter Gmail or Calendar UI. This is server-controlled behavior within the advertised integration, not arbitrary downloaded code.
Dispatches remote message IDs to proxy methods including addRecipients, onPrepend, reply operations, token operations and roaming settings. — scripts/chrome.bundle.js:18
Restricts the remote iframe and extension-page connections to two vendor domain families. — manifest.json:42-43
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Implements proxy_addRecipients, proxy_onPrepend, proxy_openReply, proxy_openReplyAll and Gmail/Calendar view manipulation. — scripts/chrome.bundle.js:18
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The page bundle patches Gmail's XMLHttpRequest to observe and parse request and response data. It does not act as a general network blocker, proxy or download manager.
Wraps XMLHttpRequest.open and send, records Gmail request parameters and parses completed responses into message/thread events. — scripts/chrome.bundle.js:2
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:45-51
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Injects scripts/chrome.bundle.js from the installed extension package. — scripts/contentscript.js:1
Restricts extension-page scripts to self and remote content to framed/connected vendor origins. — manifest.json:42-43
Can ordinary websites access privileged extension features through messaging or exposed files?
A same-origin page-message bridge reaches privileged token, settings and mailbox operations. It checks message origin and manifest site scope, but does not authenticate the individual page sender or command beyond the action protocol.
Accepts window messages when event.origin equals the current page origin, forwards recognized IDs to a privileged runtime port, and posts responses back to the page. — scripts/contentscript.js:1
The scc port handler processes token, roaming-setting, tenant and active-tab actions without an additional sender-origin check. — scripts/background.js:1
Limits bridge injection to Gmail, Calendar and named SAP cloud domain families. — manifest.json:24-37
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads and writes the model, per-email token markers and per-user roaming settings through chrome.storage.sync. — scripts/background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Periodic alarm checks vendor version metadata every five minutes; no mining endpoint or algorithm appears. — scripts/background.js:1
Does it change form fields or where a form sends its information?
Remote CRM commands can add compose recipients and prepend message content, but no code changes a webpage form action or redirects submissions to an unrelated site.
proxy_addRecipients and proxy_onPrepend invoke packaged Gmail view methods with parameters received through the vendor message channel. — scripts/chrome.bundle.js:18
Extension-page form-action is none and remote iframe/connect destinations are vendor allowlisted. — manifest.json:42-43