Is Auto-Confirm Google Drive Popups safe?
We analyzed Auto-Confirm Google Drive Popups version 0.3's actual code and gave it a 86/100 trust score. This is a narrowly focused Drive helper with…
Bottom line
This is a narrowly focused Drive helper with limited access and no evidence of data collection or abuse, though it removes confirmation steps automatically.
What it can access
It can read and alter displayed Google Drive pages, which is appropriate for its automatic-confirmation purpose but still allows actions in Drive.[Q1]
Security weaknesses
Automatically confirming matching dialogs can approve an unintended Drive action if the page changes or the user did not mean to proceed.[Q8]
Signs of misuse
There is no evidence that it collects sensitive information or sends data outside the browser.[Q6][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access only to Google Drive pages and no Chrome services permissions. That scope matches its advertised purpose.
Declares one Google Drive content script and no permissions array. — manifest.json:7-18
Which websites can it run on, and can it read or change what appears on those pages?
It observes elements added directly to the Google Drive page and searches for two dialog layouts.
Starts a MutationObserver on document.body and examines added DIV elements and their classes. — drive.js:1-22
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads only node names and CSS classes before selecting confirmation buttons. — drive.js:4-16
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests no storage or cookie permission. — manifest.json:7-18
Contains no persistence code. — drive.js:1-23
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no Chrome API permissions. — manifest.json:7-18
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains no fetch, XHR, WebSocket, beacon, form submission, or URL navigation. — drive.js:1-23
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Both target dialog selectors are packaged as fixed strings. — drive.js:1-23
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically confirms matching Drive dialogs as soon as they appear. This is active behavior and the extension's stated purpose, though it removes a user confirmation step.
The description explicitly promises automatic confirmation. — manifest.json:4-6
The observer immediately calls click() for either matching dialog. — drive.js:4-15
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings-related permissions or background worker. — manifest.json:7-18
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses straightforward named functions and DOM operations. — drive.js:1-23
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains only a load listener, MutationObserver, selectors, clicks, and DOM removal. — drive.js:1-23
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Limits its content script to https://drive.google.com/drive/*. — manifest.json:11-17
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Does not create identifiers or perform network requests. — drive.js:1-23
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookie permission. — manifest.json:7-18
Does not inspect storage, requests, or input values. — drive.js:1-23
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Observes added nodes only and reads their element names and class names. — drive.js:1-23
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
All logic and selectors are packaged locally with no network path. — drive.js:1-23
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Matches two specific DIV class layouts, clicks their buttons, and removes the dialog and previous sibling. — drive.js:4-15
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Contains no network or download API. — drive.js:1-23
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no native or file-system capabilities. — manifest.json:7-18
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All behavior is contained in the packaged 23-line script. — drive.js:1-23
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Listens only for window load and DOM mutations. — drive.js:1-23
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior is fixed and contains no configuration branch. — drive.js:4-15
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The only ongoing work is a DOM child-list observer. — drive.js:1-23
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Calls click() on two hard-coded Drive dialog buttons and performs no input or form-action assignment. — drive.js:4-15