Is Google Voice (by Google) safe?
We analyzed Google Voice (by Google) version 3.0.11's actual code and gave it a 78/100 trust score. A legitimate calling tool with broad page-reading…
Bottom line
A legitimate calling tool with broad page-reading access, but no evidence of data theft or remote control.
What it can access
It reads visible text across all ordinary websites and changes phone-number text into calling links, which fits its purpose but is broad. [Q1][Q2][Q3]
Security weaknesses
Broad page access and automatic page changes could affect sensitive visible content, although form fields are excluded and no stronger weakness was found. [Q2][Q3][Q24]
Signs of misuse
No evidence shows tracking, hidden collection, remote commands, or code execution; data leaves the browser only after a user chooses a calling action. [Q6][Q7][Q12][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs a page access in every frame on every HTTP and HTTPS page and requests storage, activeTab, and contextMenus. The broad page access powers its advertised phone-number detection but exposes all visible page text to local inspection.
Matches http://*/* and https://*/* with all_frames and requests storage, activeTab, and contextMenus. — manifest.json:permissions and content_scripts
Which websites can it run on, and can it read or change what appears on those pages?
It can read and change visible text on all ordinary websites. It scans text nodes and inserts links around phone-number matches, including content added after page load.
Walks page text nodes, watches added nodes, and inserts gv-tel-link anchors. — contentscript_js.js:sb, tb, ub, vb, and MutationObserver
Runs in every frame across HTTP and HTTPS sites. — manifest.json:content_scripts
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can inspect visible page text that may contain sensitive information, but deliberately skips INPUT, TEXTAREA, SELECT, SCRIPT, STYLE, OBJECT, HEAD, NOSCRIPT, and IFRAME elements. It does not read password or form values.
Excludes sensitive/non-visible element types while scanning other text nodes. — contentscript_js.js:sb.m and ub
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores only two synced preferences: default phone-number region and whether linkification is enabled. It does not access cookies, sessions, history, bookmarks, or downloads.
Reads and writes defaultRegion and enableLinkification in chrome.storage.sync. — options_js.js:O, P, Q, and change listeners
Does not request cookies, history, bookmarks, tabs, or downloads. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests only storage, activeTab, and contextMenus. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends nothing automatically. When the user clicks a generated number link or Call via Google Voice menu item, it opens voice.google.com/calls with that phone number encoded in the URL; the popup also opens voice.google.com.
Builds a Google Voice call link containing the formatted phone number. — contentscript_js.js:vb
Opens the Google Voice call URL for the locally parsed selection. — background_js.js:contextMenus.onClicked
Opens https://voice.google.com when the toolbar popup is activated. — popup_js.js:entire file
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
No fetch, XHR, websocket, beacon, or code-download path was found. — *.js:network review
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically scans and modifies pages when linkification is enabled, but opening Google Voice and transmitting a phone number require the user to click a link, popup, or context-menu action.
Scans initial and newly added page text automatically. — contentscript_js.js:startup and MutationObserver
Creates a call tab only after the user chooses the menu item. — background_js.js:contextMenus.onClicked
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings override or management capability. — manifest.json:top-level fields
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The Google Closure and libphonenumber builds are compiled and large, but the application entry points remain identifiable and correspond to bundled source manifests. This is normal production compilation rather than strong concealment.
Compiled bundle includes readable phone parsing and page-scanning entry points. — contentscript_js.js:entire file
Lists source modules included in the build. — contentscript_js.MF:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Zero eval, new Function, or string timer calls were present in executable entry files. — *.js:dynamic-code review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses the current DOM locally and does not transmit the page URL or scan results. — contentscript_js.js:sb through startup
Requests no history or tabs permission. — manifest.json:permissions
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Storage contains only region and linkification settings; no analytics request exists. — *.js:analytics and storage review
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or webRequest permission is declared. — manifest.json:permissions
Only the clicked formatted phone number is placed into the Voice URL. — contentscript_js.js:vb
Does it record typing, form entries, clipboard contents, or screenshots?
It observes selectionchange on every page and sends the current selected text to its local worker for phone-number parsing. The value is held in memory for the context menu and is not uploaded or persisted.
Reads window.getSelection().toString() and sends it by runtime message. — contentscript_js.js:selectionchange listener
Parses the selection and retains a valid number in memory for the menu action. — background_js.js:stcmi message case
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable declaration exists. — manifest.json:top-level fields
Handles only the fixed stcmi selection message. — background_js.js:runtime.onMessage
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It changes recognized phone-number text into Google Voice links on every website where linkification is enabled. It does not alter ads, referral codes, carts, or search results for monetization.
Splits a text node and inserts an anchor pointing to the Google Voice call URL. — contentscript_js.js:vb
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads, or proxy permission. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or broad host permission is declared. — manifest.json:permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Metadata drives validation/formatting; inserted content is a constructed anchor, not executable code. — contentscript_js.js:phone metadata and vb
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or web_accessible_resources entry exists. — manifest.json:top-level fields
Uses runtime messaging internally and has no page message listener. — contentscript_js.js:messaging review
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses a fixed Voice exclusion and enableLinkification preference. — contentscript_js.js:sb constructor and startup
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Processes text nodes incrementally in response to page changes. — contentscript_js.js:tb, ub, and MutationObserver
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Form-control node names are in the exclusion list before link insertion. — contentscript_js.js:sb.m and ub