Is Copper CRM for Gmail and LinkedIn safe?
We analyzed Copper CRM for Gmail and LinkedIn version 2.0.510's actual code and gave it a 38/100 trust score. This is a legitimate CRM with sensitive…
Bottom line
This is a legitimate CRM with sensitive access, but its exposed message bridge creates a serious security risk.
What it can access
It can read tracked Gmail messages, Calendar pages, Copper data, and optional LinkedIn profiles, which fits CRM features but exposes sensitive information.[Q1][Q3][Q6][Q21]
Security weaknesses
Any webpage may invoke privileged extension actions through an unauthenticated bridge, potentially exposing stored Copper access data.[Q21]
Signs of misuse
The extension sends tracked email contents to Copper and account-linked activity, identifiers, and some profile information to analytics services.[Q6][Q13][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has persistent access to Gmail, Google Calendar, and Copper, plus optional LinkedIn access and powerful tabs, scripting, storage, and web-request capabilities.
Declares the site scopes, privileged APIs, and automatic Gmail and Calendar content scripts. — manifest.json:15-21,32-39,51-80
Which websites can it run on, and can it read or change what appears on those pages?
It reads Gmail and Calendar page data for CRM features and, after optional permission, extracts LinkedIn profile details.
Runs packaged integrations on Gmail and Calendar and can be granted LinkedIn access. — manifest.json:20-21,51-80
The linkedin/read-properties module reads a profile's name, photo URL, title, company, and About text. — background.js:2
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It handles sensitive email bodies, recipients, account identifiers, CRM records, and LinkedIn profile data as part of its advertised workflow.
The email tracker decodes Gmail send requests and extracts the subject, full HTML body, and To, CC, and BCC recipients. — background.js:2
The packaged CRM application handles Copper records and optional LinkedIn profile properties. — assets/chrome-ext.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can inspect active tab URLs and extension-local account data, but no browser history, bookmarks, saved passwords, or autofill database access was found.
Requests tabs and storage, but not history, bookmarks, passwords, or identity. — manifest.json:32-39
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the device, clipboard, desktop-capture, or downloads permissions. — manifest.json:32-39
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Tracked outgoing email contents go to Copper, while account-linked product telemetry goes to Segment.
The email-tracker-listener extracts subject, body, and recipients, then utils/email-tracker posts them to app.copper.com. — background.js:2
The analytics message handlers POST user, group, event, property, and context payloads to api.segment.io. — background.js:2
The app-analytics service links Segment requests to a Copper company user ID and sends event properties. — assets/chrome-ext.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
Copper account settings and feature data affect CRM behavior, including whether email tracking starts enabled, but no setting supplies executable code.
The email tracking selector reads setting_email_tracking_checked_by_default from the signed-in Copper company user. — assets/chrome-ext.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension automatically starts its packaged CRM integration when a signed-in Gmail or Calendar account is detected.
Observes Google page changes, extracts the visible account email, and sends host.boot.ready. — content-scripts/hosts/boot/shared.js:1
HostBootReady injects the packaged Copper application, tunnel, and host API into the tab. — background.js:2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings, proxy, privacy, or search-provider permissions. — manifest.json:32-39
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Large application bundles are minified, but packaged source maps expose readable module names and source; concealment was not demonstrated.
The production app is bundled on one minified line. — assets/chrome-ext.js:1
Includes readable sources and source content for the CRM modules. — assets/chrome-ext.map:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
A bundled JSON reference resolver uses eval only after a restrictive property-path regular expression; it is not a remote-code loader. — assets/chrome-ext-chunk.app.js:2
A vendor global-object fallback contains new Function('return this'); no remotely supplied text reaches it. — assets/vendor.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares scoped host access and tabs, but not history. — manifest.json:15-21,32-39
The host and LinkedIn integrations read and normalize the current tab URL. — assets/chrome-ext.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It uses Copper user and company identifiers for Segment analytics and email-open tracking; one analytics path includes a LinkedIn profile name.
Segment requests contain companyUserId, group traits, event properties, context, and a server-provided write key. — background.js:2
LinkedIn name normalization logs both originalName and truncatedName through app analytics. — assets/chrome-ext.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It stores a Copper access token and user ID for authenticated Copper requests; no Google cookies or passwords are read.
utils/chrome-storage-local defines apiKey and companyId records; email requests use apiKey.access_token and apiKey.user_id. — background.js:2
Does not request cookies or identity permission. — manifest.json:32-39
Does it record typing, form entries, clipboard contents, or screenshots?
It reads outgoing tracked email bodies and recipients, but no general keystroke logger, screenshot, camera, or microphone capture was found.
The Gmail sync decoder extracts the subject, HTML body, and To, CC, and BCC addresses only when the message contains Copper's tracking pixel and send flags. — background.js:2
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote responses provide CRM data and settings, while privileged actions are selected by local runtime messages. — background.js:2
The untrusted control path originates in DOM events from the host page, not a server command channel. — content-scripts/web-extension-tunnel.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
HostBootReady injects Copper's packaged UI and host integration files. — background.js:2
The LinkedIn reader can temporarily reposition hidden sections to trigger the site's lazy loading, then restores them. — background.js:2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It inspects Gmail send request bodies and blocks the sender's own Copper tracking pixel request; it does not act as a general proxy or download interceptor.
Registers onBeforeRequest with requestBody access for mail.google.com/sync and processes only messages containing Copper's pixel. — background.js:2
Blocks matching creator-tagged space.gif tracking pixels on Googleusercontent. — rulesets/email-tracker.json:1-12
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or external-program capability. — manifest.json:32-39
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The packaged app consumes Copper API records, settings, and a Segment write key. — assets/chrome-ext.js:1
The AJAX proxy restricts destinations to manifest host origins and parses responses as data. — background.js:2
Can ordinary websites access privileged extension features through messaging or exposed files?
A page-accessible page bridge can invoke privileged extension handlers without authenticating the message or limiting allowed actions.
Listens for sendToServiceWorker on a predictable DOM element, forwards arbitrary event.detail to runtime.sendMessage, and publishes the response on another DOM element. — content-scripts/web-extension-tunnel.js:1
The runtime listener dispatches solely by message.action with no sender or action authorization; storage.local.get returns any requested keys. — background.js:2
Copper's authenticated request helper stores its access token under apiKey, making credential disclosure through the bridge consequential. — background.js:2
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
EmailTrackingSelector initializes from setting_email_tracking_checked_by_default, adds a pixel when true, and exposes an onTrackToggle control that removes it when disabled. — assets/chrome-ext.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The worker and content scripts implement the CRM integration; no miner, mining endpoint, or compute worker is declared. — manifest.json:44-46,51-80
Does it change form fields or where a form sends its information?
It adds or removes Copper's tracking pixel in the Gmail composer, but no form action is redirected and no unrelated input value is silently replaced.
EmailTrackingSelector calls composerView.addTrackingPixel or removeTrackingPixel according to the visible tracking control. — assets/chrome-ext.js:1