Is MS Office 365 Apps by OUBRECHT.com safe?
We analyzed MS Office 365 Apps by OUBRECHT.com version 14.0's actual code and gave it a 78/100 trust score. This appears to be a simple Microsoft 365…
Bottom line
This appears to be a simple Microsoft 365 launcher with unnecessarily broad page access but no evidence of misuse.
What it can access
It runs on every website despite being a Microsoft 365 link launcher, while its only named permission is local storage.[Q1][Q8]
Security weaknesses
Broad page access is an unnecessary security weakness, although the reviewed code shows no meaningful page-data access or exposed control channel.[Q1][Q2][Q16]
Signs of misuse
There is no evidence of tracking, sensitive-data collection, remote commands, or altered web traffic; it only presents fixed Microsoft links.[Q6][Q7][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It declares a page access on every URL despite functioning as a popup link launcher.
Loads funkce.js on <all_urls> and requests storage. — manifest.json:9-16
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Builds fixed launcher HTML and assigns it only to an element named ms_list. — funkce.js:57-71
Immediately binds popup-specific radio elements and starts popup preference loading; ordinary pages lack these controls. — funkce.js:124-128
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The only DOM reads target fixed popup IDs and the only data value is the launcher type preference. — funkce.js:57-128
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores the user's Business or Personal launcher selection locally and requests no history or browsing-data permission.
Writes and reads the mstypevalue preference in extension local storage. — funkce.js:99-118
Requests storage only. — manifest.json:15-17
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
The sole named permission is storage. — manifest.json:15-17
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains fixed Microsoft URLs used as ordinary anchors. — funkce.js:9-49
Renders those URLs into target=_blank links without sending extension data. — funkce.js:57-71
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Defines both launcher lists directly in the shipped JavaScript. — funkce.js:9-49
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Chrome attempts to load the launcher script automatically on every page, but meaningful behavior occurs only in the extension popup.
Registers funkce.js as an all-URL content script. — manifest.json:9-13
The popup supplies the specific elements that the script requires. — background.html:83-89
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests only storage. — manifest.json:15-17
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable source exposes the complete link lists, renderer and preference handling. — funkce.js:1-128
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Complete script contains no dynamic-code execution sink. — funkce.js:1-128
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares broad content-script matching but no history or tabs permission. — manifest.json:9-16
Never reads location, referrer or tab URLs. — funkce.js:1-128
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The only persisted value is the explicit launcher-type choice. — funkce.js:99-118
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission. — manifest.json:15-17
Creates normal links to Microsoft; it does not inspect authentication state. — funkce.js:9-71
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Handlers cover only launcher-link closing and the two popup radio controls. — funkce.js:75-128
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no background message receiver or externally_connectable access. — manifest.json:1-22
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Writes only to the popup-specific ms_list element. — funkce.js:57-71
Defines ms_list and the radio controls inside the extension popup. — background.html:83-89
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests none of the required network or download permissions. — manifest.json:15-17
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests storage only. — manifest.json:15-17
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All destinations are packaged constants. — funkce.js:9-49
Creates ordinary anchor elements rather than fetching or executing responses. — funkce.js:57-71
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no window message or extension runtime message listener. — funkce.js:1-128
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Saves and restores the chosen link-set type in extension local storage. — funkce.js:90-118
Popup radio clicks switch the selected list. — funkce.js:124-125
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Its only loop renders the finite packaged list of Microsoft services. — funkce.js:57-70
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The only inputs select Business or Personal mode inside the popup. — background.html:83-89
Radio handlers only rebuild the fixed link list. — funkce.js:124-125