Is 1 Click Google Forms™ safe?
We analyzed 1 Click Google Forms™ version 3.0.0's actual code and gave it a 96/100 trust score. This is a narrowly scoped extension with no meaningful…
Bottom line
This is a narrowly scoped extension with no meaningful evidence of misuse or dangerous access.
What it can access
It requests no browser, device, or website access, which fits an extension that opens a new Google Form. [Q1] [Q2] [Q4] [Q5]
Security weaknesses
No meaningful weakness was found: packaged code is readable, uses no dynamic execution, and exposes no privileged features to websites. [Q10] [Q11] [Q21]
Signs of misuse
No misuse was found; it sends no information, accepts no remote commands, and changes no links or web traffic. [Q6] [Q16] [Q17] [Q18]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Contains no permissions, optional_permissions, host_permissions or content_scripts entry. — manifest.json:1-35
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares only an action popup and homepage metadata. — manifest.json:17-35
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The popup handler only creates a tab for a fixed Google Forms URL. — background.js:1-3
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests no browser-data permissions. — manifest.json:1-35
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests no device or file-related permissions. — manifest.json:1-35
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Opens a fixed Google Forms URL and sends no payload. — background.js:1-3
Only opens a static welcome page and registers an uninstall URL. — js/welcome.js:1-22
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The worker is the packaged welcome.js file. — manifest.json:4-6
The popup loads only two packaged scripts. — popup.html:22-23
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It opens its vendor welcome page once after first installation and registers a vendor uninstall page. Opening Google Forms requires a click.
Checks reason=install before opening /welcome and calls setUninstallURL for /uninstall. — js/welcome.js:7-20
Google Forms opens only from the popup button's click listener. — background.js:1-3
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings permission. — manifest.json:1-35
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains one direct click handler. — background.js:1-3
Contains a readable installation helper. — js/welcome.js:1-22
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses a normal function callback. — background.js:1-3
Contains no dynamic execution primitive. — js/welcome.js:1-22
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no history or tabs-reading permission. — manifest.json:1-35
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Does not generate identifiers or emit events. — background.js:1-3
Builds only the extension's store review URL. — js/rate.js:1-9
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or host permission. — manifest.json:1-35
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no page or capture access. — manifest.json:1-35
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable declaration. — manifest.json:1-35
Makes no remote request for instructions. — js/welcome.js:1-22
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no content_scripts or scripting permission. — manifest.json:1-35
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Opens only https://docs.google.com/forms/create after a click. — background.js:1-3
Requests no request-interception or proxy permission. — manifest.json:1-35
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:1-35
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads only packaged background.js and rate.js. — popup.html:22-23
Loads packaged welcome.js as the worker. — manifest.json:4-6
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no content script or externally_connectable entry. — manifest.json:1-35
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses one fixed Google Forms destination. — background.js:1-3
Uses the fixed manifest homepage for install/uninstall pages. — js/welcome.js:1-22
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains only a tab-opening click handler. — background.js:1-3
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No page access is declared. — manifest.json:1-35
Opens Google Forms but does not interact with the page after navigation. — background.js:1-3