Is Save to Google Drive safe?
We analyzed Save to Google Drive version 3.0.9's actual code and gave it a 74/100 trust score. Useful but privacy-sensitive: it has broad website access…
Bottom line
Useful but privacy-sensitive: it has broad website access and can save visible or page-embedded information, with no evidence of abuse or remote control.
What it can access
It can access every website and capture visible or page-embedded information, including sensitive text, when you save content. [Q1][Q3]
Security weaknesses
Broad page access and capture create meaningful privacy exposure, though capture is user-triggered and no concrete takeover weakness was found. [Q2][Q10]
Signs of misuse
Saved content goes to Google Drive for the stated feature, with no evidence of tracking, hidden actions, or remote commands. [Q6][Q8][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site host access, tabs, script injection, screenshots and MHTML capture, web-response observation, Google identity, printing, context menus, notifications, and storage. These permissions are powerful but directly support saving pages, links, media, screenshots, and print jobs to Drive.
Requests <all_urls>, contextMenus, identity, printerProvider, pageCapture, tabs, webRequest, scripting, notifications, and storage. — manifest.json:permissions and host_permissions
Uses all-site access for user-selected URL downloads, page serialization, MHTML, visible screenshot, region screenshot, and full-page screenshot flows. — js/uploadpagebootstrap.js:UrlDownloader and Capturer implementations
Registers a Save to Google Drive virtual printer that accepts PDF print jobs and uploads them. — js/backgroundpagebootstrap.js:BackgroundPage printer listeners
Which websites can it run on, and can it read or change what appears on those pages?
It can inject known packaged scripts into the active page on any normal website to serialize HTML, inspect element geometry, or scroll and temporarily reposition page elements for full-page screenshots. Injection occurs only during a user-requested capture and the scrolling path restores the page afterward.
All-site host access plus scripting and tabs allows on-demand injection across normal webpages. — manifest.json:host_permissions and permissions
Injects fixed packaged capture scripts into the chosen tab after a save action. — js/uploadpagebootstrap.js:HtmlScrapeCapturer, ImageEntireCapturer, ImageSelectCapturer
Scrolls the page and hides or repositions fixed elements while stitching a full-page image, then restores them. — js/contentscriptscroll.js:ContentScriptScroll implementation
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
A requested full-page save can serialize the page's HTML or capture its visible pixels, so sensitive text and any visibly rendered form information can be included. I found no keylogger or background form watcher, and the raw HTML path does not contain special code that continuously reads typed values.
Returns the active document's complete html.outerHTML after an explicit capture request. — js/contentscriptraw.js:ContentScriptRaw.init
Clones the complete page DOM, inlines accessible linked stylesheets, and returns the clone's outerHTML. — js/contentscriptexpand.js:ContentScriptExpand implementation
Captures visible pixels or stitches the full rendered page, which can include sensitive information shown on screen. — js/uploadpagebootstrap.js:ImageCapturer and ImageEntireCapturer
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It obtains a Google OAuth access token and the signed-in account's email address to upload files and select the account-specific Drive folder. It can read the active tab's URL and title but does not request browser cookies, stored history, bookmarks, or downloads.
Uses drive.file and userinfo.email scopes with the identity permission, but does not request cookies, history, bookmarks, or downloads. — manifest.json:oauth2 and permissions
Uses chrome.identity.getAuthToken and calls Google's user-info endpoint to identify the selected Drive account. — js/backgroundpagebootstrap.js:Client and UserId implementations
Reads the clicked tab's URL, title, ID, and cached content type to select the save format. — js/backgroundpagebootstrap.js:BrowserAction implementation
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can receive a PDF document only when the user chooses its Save to Google Drive virtual printer. It can also fetch a file: URL after the user invokes a save and has separately enabled Chrome's file-URL access.
Advertises one PDF-only virtual printer and uploads print data supplied by Chrome when the user prints to it. — js/backgroundpagebootstrap.js:BackgroundPage.addPrinterListeners
Checks chrome.extension.isAllowedFileSchemeAccess before fetching a user-selected file: URL. — js/uploadpagebootstrap.js:UrlDownloader.startDownload
Declares no camera, microphone, geolocation, clipboard, nativeMessaging, or broad local-file API. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the content the user chose to save—page HTML or MHTML, screenshots, fetched links or media, and PDF print jobs—to Google Drive. It also requests the account email from Google and can send a small SafeValues compatibility report containing only the extension-page hostname and report type to Google's CSP reporting service.
Creates Drive metadata and uploads the selected content in authenticated chunks to www.googleapis.com/upload/drive/v2/files. — js/uploadpagebootstrap.js:ResumableUploader implementation
Routes a user-selected PDF print job into the same Google Drive resumable uploader. — js/backgroundpagebootstrap.js:printerProvider.onPrintRequested handler
May send a sampled compatibility heartbeat or sanitization result to csp.withgoogle.com; the payload contains the extension page hostname, a fixed report ID/type, and optional sanitizer error text, not captured webpage content. — js/uploadpagebootstrap.js:SafeValues reporting module
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Points to clients2.google.com/service/update2/crx for standard extension updates. — manifest.json:update_url
UrlDownloader fetches user-selected URLs for content, not for code execution. — js/uploadpagebootstrap.js:1015-1025
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Opens the upload flow from explicit toolbar and context-menu events. — js/backgroundpagebootstrap.js:BrowserAction.initialize and createContextMenus
Receives print data only when Chrome invokes the selected virtual printer. — js/backgroundpagebootstrap.js:printerProvider listeners
Automatically caches only the main-frame Content-Type by tab ID and sends nothing externally. — js/backgroundpagebootstrap.js:TabContentType implementation
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The main worker and upload UI are large Closure-compiled bundles without source maps, which makes independent review slower. The extension-owned flows and fixed network destinations remain traceable, and I found no deliberate string concealment, encrypted data, or runtime-downloaded code.
Contains roughly 552 KB of compiled Closure library and upload/capture application code without a source map. — js/uploadpagebootstrap.js:1-end
Contains roughly 307 KB of compiled Closure library and background logic without a source map. — js/backgroundpagebootstrap.js:1-end
All runtime entry points refer to packaged files; no remote script is declared. — manifest.json:background and options_page
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Sets COMPILED = true, while goog.globalEval and the Trusted Types eval check appear inside development-loader code gated by !COMPILED. — js/backgroundpagebootstrap.js:66-128
Contains the same compiled-out Closure debug loader and no application call that evaluates downloaded or captured content. — js/uploadpagebootstrap.js:68-130
Carries Closure's unused eval helpers before a small capture routine that only serializes outerHTML. — js/contentscriptraw.js:68-70
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
A read-only webRequest listener extracts only the Content-Type header and stores it under the tab ID; it does not store the request URL. — js/backgroundpagebootstrap.js:TabContentType constructor and responseStartedCallback_
Uses the chosen tab or link only after a direct save action. — js/backgroundpagebootstrap.js:BrowserAction and context-menu handlers
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
UserId stores the authenticated Google email for per-user folder mapping; this is account identification, not browser fingerprinting. — js/optionspagebootstrap.js:211-215
OAuth client_id and scopes are limited to drive.file and userinfo.email; no tracking or analytics scope is requested. — manifest.json:oauth2
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends OAuth authentication data and the user-selected page, image, media, link, or print contents to Google services. That is the advertised function.
Requests only Drive file creation/access and Google account email scopes. — manifest.json:oauth2
Adds the Google OAuth bearer token to Drive requests and uploads the selected content. — js/uploadpagebootstrap.js:Client.authAndSend_ and ResumableUploader
Uploads a chosen PDF print job through the Drive client. — js/backgroundpagebootstrap.js:BackgroundPage.addPrinterListeners
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture the visible tab, a selected region, or a stitched full-page screenshot after the user chooses that save mode. It does not continuously record typing, form changes, clipboard contents, camera, or microphone.
Uses chrome.tabs.captureVisibleTab for one-shot, selected-region, and scrolling full-page image capture. — js/uploadpagebootstrap.js:ImageCapturer, ImageSelectCapturer, and ImageEntireCapturer
Coordinates page dimensions, scrolling, fixed-element handling, and restoration for the stitched screenshot. — js/contentscriptscroll.js:ContentScriptScroll implementation
Declares no clipboard, camera, or microphone permission. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable or web_accessible_resources entry and no always-running content script. — manifest.json:1-end
The worker's single message listener returns stored context-menu click data to an extension-owned upload page. — js/backgroundpagebootstrap.js:runtime.onMessage listener
Listeners are installed immediately before injecting a fixed packaged capture helper into the selected tab. — js/uploadpagebootstrap.js:HtmlScrapeCapturer and screenshot message handlers
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Registers onResponseStarted with responseHeaders and only copies the Content-Type value into local state. — js/backgroundpagebootstrap.js:TabContentType constructor and responseStartedCallback_
Uses webRequest without blocking or declarativeNetRequest and declares no proxy permission. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Serializes document.documentElement.outerHTML and sends it via chrome.runtime.sendMessage; no obfuscation or dynamic code execution. — js/contentscriptraw.js:69
Handles scrollTo and restore messages for full-page capture; no hidden payload. — js/contentscriptscroll.js:71-77
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no web_accessible_resources, externally_connectable, or persistent content_scripts declaration. — manifest.json:1-end
Injects fixed packaged files into a specific tab and communicates through chrome.runtime messaging unavailable to page JavaScript. — js/uploadpagebootstrap.js:scripting.executeScript calls
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Stores local choices for save format, destination folder, conversion, and post-upload behavior. — js/optionspagebootstrap.js:Options implementation
Starts actions from clicks and print callbacks, with no fetched feature flags or remote targeting logic. — js/backgroundpagebootstrap.js:BackgroundPage handlers
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Full-page capture uses OffscreenCanvas to stitch tiles, then restores scroll state; it is a finite, user-initiated operation. — js/uploadpagebootstrap.js:1040-1053
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.