Is Analytics Debugger safe?
We analyzed Analytics Debugger version 2.4.7's actual code and gave it a 62/100 trust score. This is a purpose-aligned analytics debugger with broad…
Bottom line
This is a purpose-aligned analytics debugger with broad access and meaningful privacy exposure, but no established abusive collection.
What it can access
It can inspect analytics traffic and page data across all sites, including request bodies, and alter selected analytics traffic; this broadly fits debugging but is powerful. [Q1][Q3][Q18]
Security weaknesses
All-site monitoring can expose analytics requests and lets the extension block or redirect analytics traffic; this is powerful but tied to its debugging purpose. [Q2][Q18]
Signs of misuse
It sends usage and device details to Google Analytics, but no evidence shows it sends captured page or analytics reports elsewhere. [Q6][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site access plus webRequest, webNavigation, scripting, storage, and declarativeNetRequest. This is unusually broad access, but it matches a DevTools tool designed to inspect analytics on whichever tab the user debugs.
Declares *://*/* and the webRequest, webNavigation, scripting, storage, and declarativeNetRequest permissions. — manifest.json:permissions and host_permissions
Registers listeners for the inspected tab and injects functions into its main world. — dist/assets/5f867810.js:s3 and cr functions
Which websites can it run on, and can it read or change what appears on those pages?
When the DevTools panel is active, it injects packaged functions into the inspected page's main JavaScript world to observe analytics data layers and vendor objects. Optional tools can block clicks or change analytics debugging behavior.
Uses chrome.scripting.executeScript with world MAIN to install analytics instrumentation in the inspected tab. — dist/assets/5f867810.js:cr().add and Gw
Uses devtools.inspectedWindow.eval to add and later remove a click-prevention handler when the user enables the tool. — dist/assets/5f867810.js:ModalPalette click blocker
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read detailed analytics traffic from the inspected tab, including full URLs, query parameters, request bodies, headers, selected response bodies, data-layer events, and vendor configuration. These may contain identifiers, page paths, form-like event values, or account details supplied to analytics systems.
Builds report entries from request URL, method, query string, raw request body, response headers, and selected response content. — dist/assets/5f867810.js:s3 webRequest listener and zi
Hooks dataLayer, Tealium, Adobe Launch, and related page objects and forwards their event data to the panel. — dist/assets/5f867810.js:Gw analytics hooks
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores debugger settings, enabled vendors, environment-switching profiles, preview codes, and update-modal state in extension storage. I found no cookies permission or browser-history query, although inspected network data can expose session-like values embedded in analytics requests.
Loads and persists settings with chrome.storage.local, including debugging feature configuration. — dist/assets/5f867810.js:Kw
Stores the version/update-modal state in chrome.storage.session. — dist/background/index.mjs:onInstalled listener
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No camera, microphone, geolocation, desktopCapture, tabCapture, or notifications permission is declared. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends its own usage events and extension/device context to Google Analytics. Optional tools also contact Tealium and Adobe asset services, but I found no network sink that uploads the captured request report or page analytics contents.
Creates Google Analytics tracker G-2Y3L8ETZRQ and sends UI events with extension version, OS, architecture, and incognito state. — dist/assets/5f867810.js:Hw and q4
Fetches a named Tealium profile when the user opens that optional debugging view. — dist/assets/41ff017e.js:Tealium profile lookup
Sends a HEAD request to a selected Adobe Launch environment script before switching. — dist/assets/9f2ec6f3.js:environment check
Does it download or run code, settings, or instructions supplied by a remote server?
User-enabled debugger settings can cause the browser to load alternate Google, Tealium, or Adobe analytics scripts from remote URLs. The extension does not fetch and execute arbitrary server text inside its own extension pages.
Builds temporary declarativeNetRequest redirects for Google debug libraries and configured Tealium or Adobe Launch environments. — dist/assets/5f867810.js:qw
Extension pages use script-src self, preventing ordinary remote script execution in the extension itself. — manifest.json:content_security_policy
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
A tiny content-script bridge runs on every page at load time, but full traffic inspection and page instrumentation are tied to opening and using the DevTools panel. The always-on bridge does not itself collect or transmit browsing content.
Loads the bridge on <all_urls>. — manifest.json:content_scripts
Forwards a named custom event to extension runtime and announces readiness; it contains no network request or page-data collection loop. — dist/contentScripts/index.global.js:entire file
Starts inspected-tab listeners from the DevTools panel application. — dist/assets/5f867810.js:s3
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Creates session rules to block GA3/GA4 collection or redirect Google, Tealium, and Adobe Launch scripts. — dist/assets/5f867810.js:qw
Rebuilds rules from persisted visible feature settings. — dist/assets/5f867810.js:Kw
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The production bundle is heavily minified and ships without source maps. Entry points and security-relevant browser services remain traceable, but the lack of original source makes a complete semantic review harder.
A 414 KB single-line minified application bundle contains most behavior. — dist/assets/5f867810.js:entire file
Lists no .map files or original application source files. — inventory.json:files
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
It deliberately executes packaged string snippets in the inspected webpage through devtools.inspectedWindow.eval, and its bundled Cryo deserializer contains new Function for serialized functions. The extension's self-only CSP should block new Function in the panel, but inspectedWindow.eval remains an active debugging mechanism.
Passes packaged JavaScript strings to devtools.inspectedWindow.eval for navigation and click blocking. — dist/assets/5f867810.js:AdobeLaunchView and ModalPalette
Creates new Function from strings prefixed with _CRYO_FUNCTION_. — dist/assets/5f867810.js:n3 Cryo deserializer
Sets extension_pages to script-src self without unsafe-eval, which should block Function construction in the panel. — manifest.json:content_security_policy
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Navigation creates local page records while telemetry page_location is constructed from the extension origin and internal route. — dist/assets/5f867810.js:addPage and Hw
Outgoing-link telemetry covers links clicked inside the extension UI, not arbitrary links on inspected pages. — dist/assets/5f867810.js:GA event emitters
Does it create a persistent ID or browser fingerprint to recognize you?
Its Google Analytics client creates a random persistent client ID and session ID, and reports the operating system, CPU architecture, version, and whether the panel is in incognito mode. I found no canvas, font, or hardware fingerprinting of inspected pages.
Generates client_id and session_id values for Google Analytics measurement protocol events. — dist/assets/5f867810.js:q4 tracker initialization
Adds is_in_incognito, version, os, and arch as persistent event parameters. — dist/assets/5f867810.js:Hw setup
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request cookies or password-related APIs. — manifest.json:permissions
Parses inspected analytics traffic into a local report; no report-upload call is present. — dist/assets/5f867810.js:zi
Extracts Adobe environment metadata from inspected responses and stores it in the panel's localStorage. — dist/assets/5f867810.js:AdobeLaunchView
Does it record typing, form entries, clipboard contents, or screenshots?
It records analytics event data and raw request bodies, which can include typed form values if the inspected website sends them to an analytics service. It does not install a general keyboard listener, read the clipboard, or capture screenshots.
Decodes raw image and ping request bodies for the inspected tab. — dist/assets/5f867810.js:s3 webRequest listener
Hooks analytics data pushes and forwards their models and messages into the local report. — dist/assets/5f867810.js:Gw
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Fetches and parses a requested Tealium profile for the tag view. — dist/assets/41ff017e.js:Tealium profile lookup
Builds environment choices from Adobe responses and installs a corresponding redirect rule after selection. — dist/assets/5f867810.js:AdobeLaunchView and qw
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Displays extension news, donation links, and a remote giveaway image inside the panel. — dist/assets/5f867810.js:splash and news UI
Request modifications target analytics libraries and collection endpoints, not commerce or search traffic. — dist/assets/5f867810.js:qw
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It can block selected analytics collection requests and redirect analytics scripts to debug or alternate environment builds. It does not configure a proxy, rewrite general request headers, or control downloads.
Creates declarativeNetRequest block and redirect session rules for GA, GTM, Tealium, and Adobe Launch patterns. — dist/assets/5f867810.js:qw
Requests declarativeNetRequest but not proxy or downloads. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:permissions
No localhost, loopback, native host, or executable-launch endpoint was found. — dist:network endpoint review
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses a documented serialized object format directly; there is no preceding encrypted or concealed payload stage. — dist/assets/5f867810.js:Cryo serializer/deserializer
The direct new Function sink is separately identified without evidence of an encoded delivery chain. — dist/assets/5f867810.js:n3
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Forwards any analytics-debugger-ext-msg-from-page CustomEvent detail through chrome.runtime.sendMessage without validation. — dist/contentScripts/index.global.js:entire file
Checks that the sender tab matches the inspected tab, then handles a fixed event-name switch that updates report state. — dist/assets/5f867810.js:s3 runtime.onMessage listener
No forwarded event case changes DNR settings, storage, tabs, or scripting; cases add parsed entries to the displayed report. — dist/assets/5f867810.js:s3 event switch
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Loads enabled vendor tools and feature settings from storage. — dist/assets/5f867810.js:Kw and Yw
Injects and captures data for the currently inspected tab as it navigates. — dist/assets/5f867810.js:s3 navigation handlers
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
CPU-intensive code is limited to UI rendering and parsing captured analytics records; no mining protocol, wallet, worker farm, or compute-job endpoint appears. — dist:bundle review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Adds a preventDefault click listener only after the user chooses the debugging command. — dist/assets/5f867810.js:ModalPalette click blocker
No form action assignment, submit listener, credential-field replacement, or submit invocation was found. — dist:DOM and form API review