Is Google Vids Screen Recorder safe?
We analyzed Google Vids Screen Recorder version 1.64.1's actual code and gave it a 84/100 trust score. This appears to be a purpose-aligned Google Vids…
Bottom line
This appears to be a purpose-aligned Google Vids helper with limited site access and no established abusive behavior.
What it can access
It can coordinate tabs and recording state on Google pages, which fits its purpose but is broader than simple storage access [Q1][Q4][Q5].
Security weaknesses
A Google Vids page can trigger a small allowlist of workflow actions, but origin checks and state limits reduce misuse risk [Q16][Q21].
Signs of misuse
It sends sampled error diagnostics and a random session value to Google Vids, but no browser-session or page-content collection is shown [Q6][Q13][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has storage, scripting, navigation, and window controls, but host access is limited to Google Vids pages.
Declares storage, scripting, webNavigation, windows, and only https://docs.google.com/* host access. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Processes a fixed set of recording lifecycle messages rather than scraping DOM content. — content_script_compiled.js:113324-113367
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The always-injected page helper only adds a hidden extension-present marker. — page_embed_compiled.js:1855-1866
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores recording workflow state and tab or window identifiers locally, then removes session values on reset.
Reads and writes extension state, recording state, recording tab/window IDs, and trigger tab ID in local storage. — background_compiled.js:113757-113835
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests no desktopCapture, tabCapture, audioCapture, videoCapture, clipboard, or downloads permission. — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Sampled error diagnostics can be sent to Google Vids, the same service the user is using; no media upload path is present in the extension.
Configures the error reporter for https://docs.google.com/videos/jserror with extension name and version context. — background_compiled.js:113154-113198
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The Google Vids origin, event names, paths, and workflow constants are packaged locally. — background_compiled.js:113154-113174
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically opens Google Vids once on installation and injects its packaged helper when the known recording tab reaches a matching edit page.
The install listener opens/focuses the studio, while the filtered navigation listener injects only into the stored recording tab. — background_compiled.js:113341-113370,113398-113404
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting or proxy permissions. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The code is a very large generated Google Closure bundle, which reduces readability but is not evidence of malicious obfuscation.
Contains generated Closure and application code with source-module labels and readable symbols. — background_compiled.js:1-113921
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Sets COMPILED=true and contains Closure's loadModuleFromSource_ eval helper in dormant loader infrastructure. — background_compiled.js:1563,1878-1881
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Observes only matching Google Vids edit navigation and stores tab IDs, not the initiating page URL. — background_compiled.js:113398-113404,113544-113571
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a random diagnostic session ID for sampled error reporting to Google Vids; no advertising or cross-site tracking path was found.
Generates a session ID and initializes the Google Vids error reporter. — background_compiled.js:113182-113198,113642-113644
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies or identity permission and no externally connectable surface. — manifest.json:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The extension has no capture permissions and is scoped to Google Vids coordination. — manifest.json:1
Can a website or remote server send commands that make the extension take actions?
The Google Vids page can send fixed lifecycle instructions such as reset, close, or focus, but not arbitrary commands.
Accepts an allowlist of recording event names and routes them through workflow-state checks. — content_script_compiled.js:113324-113367,113445-113477
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates a hidden _flix_chrome_extension_exists div if absent. — page_embed_compiled.js:1855-1866
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It opens the Google Vids service and can send diagnostic errors there, but it does not intercept or proxy browser traffic.
Creates a Google Vids tab and configures its first-party error endpoint. — background_compiled.js:113182-113198,113544-113571
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or filesystem-related permission. — manifest.json:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The only eval match is dormant Closure loader code in a COMPILED=true bundle; no remote-text source reaches it. — background_compiled.js:1563,1878-1881
Can ordinary websites access privileged extension features through messaging or exposed files?
A page-to-extension bridge exists, but it is limited by Google Vids host scope, same-origin checks, recognized event names, and workflow state.
Rejects different origins, switches on a fixed event list, and sends only messages valid for the current extension state. — content_script_compiled.js:113324-113367,113445-113477
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The install event opens the studio; the extension itself only creates and tracks the tab. — background_compiled.js:113341-113354,113544-113571
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Application logic is limited to Google Vids tab and recording-state coordination. — background_compiled.js:113307-113644
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Its only direct DOM change is a hidden extension-present marker div. — page_embed_compiled.js:1855-1866