Is Google Search Maps Button safe?
We analyzed Google Search Maps Button version 1.2.4's actual code and gave it a 88/100 trust score. This is a narrowly focused Google Search enhancement…
Bottom line
This is a narrowly focused Google Search enhancement with no established misuse or meaningful security weakness.
What it can access
It reads Google search pages and their queries across listed Google domains, then changes visible Maps links, which fits its stated purpose but can involve sensitive searches [Q1][Q2][Q3][Q6].
Security weaknesses
The package contains no evidence of remote code execution, website-controlled commands, traffic interception, or access to browser settings [Q7][Q11][Q16][Q18].
Signs of misuse
No evidence shows tracking, private-data collection, hidden activity, or deceptive manipulation; it only adds visible Maps links and waits for a user click to navigate [Q12][Q14][Q17].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has content-script access to listed Google Search result pages and also requests activeTab.
Declares activeTab and injects one packaged script on specific Google Search URL patterns. — manifest.json:8-59
Which websites can it run on, and can it read or change what appears on those pages?
It reads the Google Search page URL and inspects navigation and map-result page elements.
Reads the q URL parameter and searches page anchors. — src/addMapsBtn.js:3-17
Queries Google navigation elements to choose an insertion point. — src/addMapsBtn.js:24-63
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads the user's Google search query, which can be sensitive, but uses it only to build a Google Maps link.
Reads only the q query parameter and URL-encodes it into maps.google.com. — src/addMapsBtn.js:3-11
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests only activeTab and the listed content-script matches. — manifest.json:8-59
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests none of those permissions. — manifest.json:8-59
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A user click on an added link sends the existing search query to Google Maps; the extension makes no background network request.
Constructs a maps.google.com URL containing the encoded query. — src/addMapsBtn.js:7-11
Assigns that URL to a visible Maps link. — src/addMapsBtn.js:65-77
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All behavior is contained in the packaged script. — src/addMapsBtn.js:1-156
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically updates the page after Google Search loads, but navigation to Maps requires a user click.
Runs setup when the document becomes interactive or complete. — src/addMapsBtn.js:141-155
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings permissions. — manifest.json:8-59
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive functions and direct DOM operations. — src/addMapsBtn.js:1-156
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains only packaged DOM manipulation code. — src/addMapsBtn.js:1-156
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads only window.location.search parameter q. — src/addMapsBtn.js:3-11
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no storage or network telemetry calls. — src/addMapsBtn.js:1-156
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission and the script never reads document.cookie. — manifest.json:8-59
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads the URL query and fixed result-page elements, not user input events. — src/addMapsBtn.js:1-156
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no background service or externally_connectable interface. — manifest.json:4-65
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It updates existing Maps links and inserts visible Maps buttons around Google result-page elements.
Updates or clones Google navigation anchors and inserts a Maps entry. — src/addMapsBtn.js:14-77
Wraps map images or adds an Open in Maps link. — src/addMapsBtn.js:80-138
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Contains no fetch, XHR, webRequest, downloads, or proxy API use. — src/addMapsBtn.js:1-156
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:8-59
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All logic is packaged and there are no network requests. — src/addMapsBtn.js:1-156
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Uses no runtime messaging or window message listener. — src/addMapsBtn.js:1-156
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Creates a visible anchor rather than automatically navigating. — src/addMapsBtn.js:65-77
Runs the DOM update after page load. — src/addMapsBtn.js:141-155
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Only performs small DOM searches and edits. — src/addMapsBtn.js:1-156
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Only creates or updates anchors around navigation and map-result elements. — src/addMapsBtn.js:14-138