Is Scribbl: AI Note Taker for Google Meet, Zoom, and MS Teams safe?
We analyzed Scribbl: AI Note Taker for Google Meet, Zoom, and MS Teams version 20.8's actual code and gave it a 52/100 trust score. This is a…
Bottom line
This is a purpose-aligned meeting recorder with high privacy exposure and meaningful security concerns.
What it can access
It can capture Google Meet pages, microphone audio, tab media, transcripts, chat and participant details, which fit note-taking but are highly sensitive [Q1][Q5][Q6][Q14].
Security weaknesses
A weak message relay may let eligible page content trigger recording-related actions, although a complete website-to-privileged path is unproven [Q16][Q21].
Signs of misuse
The extension sends meeting content and recordings, tracks users, and may automatically replay Meet activity or collect diagnostics under remote settings [Q6][Q12][Q15][Q22].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests the access needed to instrument Google Meet, capture tab media, use a background recording document, store transcripts, and contact Scribbl, S3, Google, and Hugging Face services. Much of this matches its recording purpose, but the resulting access includes highly sensitive meeting content and media.
Declares tabCapture, offscreen, storage-related capabilities and runs both isolated- and MAIN-world scripts on Google Meet. — manifest.json:permissions, host_permissions, content_scripts
Captures the selected tab and microphone, combines their audio, records media chunks, and queues them for upload. — offscreenVideoRecorder/src/offscreen/offscreenVideoRecorder.ts:359-749
Initializes analytics, server configuration, captions, chat, page diagnostics, and WebRTC instrumentation on each Meet session. — content/src/content/index.ts:437-546
Which websites can it run on, and can it read or change what appears on those pages?
It runs automatically on Google Meet and Scribbl's own web application. On Meet it reads and changes meeting UI, observes captions and chat, instruments WebRTC and fetch behavior in the page's MAIN world, and adds its toolbar.
Loads inject-rtc.js in the page's MAIN world and additional scripts in an isolated world on meet.google.com, plus its main content script on extension.app.scribbl.co. — manifest.json:content_scripts
Wraps RTCPeerConnection, RTCDataChannel, and fetch on Meet to observe caption, participant, chat, and roster traffic. — inject-rtc.js:1
Starts Meet instrumentation, caption and chat capture, analytics, diagnostics, and the visible Scribbl toolbar. — content/src/content/index.ts:383-597
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
On Google Meet it can inspect page content, captions, chat, participant details, and the full page page. I found no password or payment-field collector, and PostHog is configured to mask input values, but the extension still has technical access to sensitive meeting-page information.
A failure diagnostic serializes document.body.outerHTML, up to 6 MB, for upload. — content/src/content/index.ts:276-316
Reads Google Meet chat messages and sender information for storage and synchronization. — content/src/content/dom/chatScraper.ts:1-end
Meet session replay masks all form inputs and named caption/chat selectors, showing that other page structure remains recordable. — content/src/common/posthog-content.ts:102-143
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension uses the browser’s existing Scribbl session cookies when contacting backend.scribbl.co and caches the returned account information. It does not use cookie, history, bookmark, or download permissions to access unrelated browser data.
The service worker requests /auth/userinfo with credentials included and caches the resulting user information. — background.js:1
The popup sends logout to the Scribbl backend with credentials included. — popup/popup.js:1
Declared permissions do not include cookies, history, bookmarks, or downloads. — manifest.json:10-15
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can record the active tab's audio and video and the microphone after the recording flow grants access. A separate optional language feature repeatedly samples remote-participant audio from Meet media elements and processes it locally.
Declares tabCapture and offscreen access. — manifest.json:permissions
Obtains tab and microphone MediaStreams, mixes their audio, and constructs a MediaRecorder. — offscreenVideoRecorder/src/offscreen/offscreenVideoRecorder.ts:493-635
When the feature is enabled, samples 15 seconds of remote-participant audio every minute for local language detection. — content/src/content/experiments/languageDetect.ts:1-20,281-535
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends meeting transcripts, chat, participants, titles, recordings, account identity, analytics, and detailed operational logs outside the browser. Sampled PostHog session replays send Meet-page activity, and a failure path can send up to 6 MB of page HTML with the user's ID and email.
Posts meeting registration, transcript, chat, roster, RTC, and DOM-failure payloads to Scribbl's backend. — background/src/api/api.ts:85-305
Creates multipart uploads and PUTs recorded media chunks to server-provided S3 URLs. — offscreenVideoRecorder/src/offscreen/offScreenAPI.ts:1-153
Initializes PostHog through Scribbl's proxy, identifies signed-in users, and conditionally starts full session recording. — content/src/common/posthog-content.ts:97-199
Batches logs containing user identity, meeting trace ID, environment, and messages to Axiom using a credential embedded in the package. — background/src/logger/logger.ts:1-53,403-480
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads server-controlled selector and behavior settings at each meeting, including capture sample rates and diagnostic switches. An optional language feature also downloads a fixed Whisper model from Hugging Face and runs it locally.
Fetches /config/selectors from Scribbl and merges remote selectors and constants into the active configuration. — background/src/background/store.ts:1340-1435
Uses remote constants to control session-replay rate, RTC capture mode and sampling, deeper tracing, and DOM diagnostics. — content/src/content/index.ts:437-546,662-805
Disables local models and lazily downloads Xenova/whisper-base through the bundled Hugging Face runtime. — content/src/content/experiments/languageDetect.ts:188-247
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On matching Meet pages it automatically initializes analytics, may begin a sampled session replay, fetches remote configuration, instruments WebRTC, and captures or retries transcript and chat uploads according to settings. Media recording itself follows a shortcut or visible recording flow.
Runs the meeting initialization automatically after detecting a Meet ID. — content/src/content/index.ts:383-597
Starts session recording automatically for trial users and a configured random sample of other meetings. — content/src/common/posthog-content.ts:178-199,279-313
Schedules repeated synchronization and retry work for locally stored meeting data. — background/src/background/index.ts:1380-1795
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains embedded original source for the Meet UI, analytics, capture, and network-listener modules. — content/content.js.map:1
Contains embedded original source for server API, storage, message handling, configuration, and logging. — background.js.map:1
Contains embedded original source for recording, chunk storage, and upload behavior. — offscreen/offscreenVideoRecorder.js.map:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
protobufjs calls eval on a fixed expression that reconstructs `require`; its argument is not remote or user-controlled. — proto-bundle.js:1
Contains Webpack's fixed new Function('return this') global fallback and ONNX/Emscripten wrapper generation. — content/content.js:1
The local ONNX runtime builds JavaScript wrapper functions from internal type metadata for WebAssembly bindings. — 81863defda783b69f64c.mjs:1
Does it track the websites, pages, searches, or links you visit?
It does not track general browsing, but it does track visits and activity on Google Meet. PostHog uses persistent identity, meeting telemetry records duration and capture state, and sampled session replay records the Meet interface.
Limits page execution to Google Meet and Scribbl's own application rather than all websites. — manifest.json:content_scripts
Persists analytics identity, associates it with account details, and may record the Meet page session. — content/src/common/posthog-content.ts:97-199
Sends a detailed per-meeting result event with duration, capture status, participant counts, browser state, and instrumentation outcomes. — content/src/content/index.ts:880-1010
Does it create a persistent ID or browser fingerprint to recognize you?
It creates an installation UUID, persists PostHog identity in Google Meet's local storage, and aliases that anonymous installation to the user's Scribbl email after sign-in. This allows analytics activity to be linked across meetings and to an identified account.
Generates and stores an install_id on first install and sends an extension_installed analytics event. — background/src/background/index.ts:1230-1260
Uses localStorage persistence and identifies the PostHog person by the user's email and account attributes. — content/src/common/posthog-content.ts:102-108,145-190
Fetches the stored install ID and aliases it to the identified PostHog profile. — content/src/common/posthog-content.ts:232-277
Does it send cookies, session details, authentication data, or page contents elsewhere?
Authenticated Scribbl cookies are sent to Scribbl's backend, and meeting transcripts, chat, participant data, titles, recordings, page replay data, and diagnostic HTML can be sent to remote services. I found no access to unrelated website cookies or browser session tokens.
Uses credentialed Scribbl requests and uploads meeting transcript, chat, roster, and diagnostic payloads. — background/src/api/api.ts:18-305
Configures PostHog session replay of the Meet DOM, cross-origin frames, styles, fonts, and canvas activity, with selected masking. — content/src/common/posthog-content.ts:102-143
Uploads recorded media chunks to Scribbl-authorized S3 destinations. — offscreenVideoRecorder/src/offscreen/offScreenAPI.ts:1-153
Does it record typing, form entries, clipboard contents, or screenshots?
It records tab audio/video and microphone audio when the recording feature is started. Separately, sampled PostHog session replay records Meet-page activity and canvas changes automatically; inputs, caption selectors, and chat selectors are masked, but the rest of the interface is not comprehensively redacted.
Creates tab and microphone streams and records the combined media. — offscreenVideoRecorder/src/offscreen/offscreenVideoRecorder.ts:493-749
Configures sampled session replay with input masking, selected text masking, iframe recording, and canvas capture at four frames per second. — content/src/common/posthog-content.ts:102-143
Automatically records every trial user's Meet session and a server-supplied fraction of other sessions. — content/src/common/posthog-content.ts:279-313
Can a website or remote server send commands that make the extension take actions?
Scribbl's server can send configuration that changes RTC capture sampling, session-replay rate, selectors, diagnostic collection, and targeted deep tracing.
Downloads and activates server-provided selectors and constants at meeting start. — background/src/background/store.ts:1340-1435
Applies remote replay, targeting, diagnostic, RTC-mode, and sampling controls. — content/src/content/index.ts:437-546,662-805
Accepts window messages when event.source is the current window and data.source begins with `scribbl-`; it has no secret, event-origin, or unforgeable-channel check. — content/src/content/networkListener.ts:250-404
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Intercepts WebRTC data channels and one fetch (SyncMeetingSpaceCollections) for meeting data; no link or ad manipulation. — inject-rtc.js:1
UI and transcript processing focused on meeting content; no DOM link rewriting or ad injection identified. — content/content.js:2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
The injector wraps fetch to clone and read selected SyncMeetingSpaceCollections responses and wraps RTC data channels to copy messages. — inject-rtc.js:1
The relevant injector runs only on Google Meet pages in the main world. — manifest.json:36-46
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
host_permissions list only cloud endpoints: scribbl S3, meet.google.com, extension.app.scribbl.co, backend.scribbl.co, huggingface.co. — manifest.json:19-24
All fetch calls target backend.scribbl.co or api.axiom.co; no 127.0.0.1 or localhost references. — background.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses Meet binary protocol messages into structured caption and participant data. — content/src/content/networkListener.ts:735-900
Loads a fixed speech model and uses it as model data through the bundled ONNX runtime. — content/src/content/experiments/languageDetect.ts:188-247,565-595
Dynamic evaluation is limited to fixed protobuf environment-detection code, not decoded input. — proto-bundle.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
An arbitrary unrelated website cannot message the extension, but scripts running on Google Meet can feed forged binary caption, chat, roster, or participant events into its page bridge. Successfully parsed events can be stored and uploaded, allowing transcript or meeting-record corruption rather than direct secret theft.
Declares no externally_connectable entry and limits content scripts to Meet and Scribbl pages. — manifest.json:externally_connectable, content_scripts
The page-message receiver trusts any same-window message with a `scribbl-*` source and ArrayBuffer before routing it to parsers. — content/src/content/networkListener.ts:250-404
Parsed page-channel records are forwarded through privileged runtime messages for local persistence and server synchronization. — content/src/content/networkListener.ts:620-900,1210-1690
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Important collection is conditional on remote settings and user cohorts. The server can change RTC and session-replay sample rates, enable diagnostic page capture, and provide a list of specific account email addresses that receive deeper WebRTC tracing.
Enables deeper tracing for email addresses in remote rtcDeepTraceEmails and passes the remote Meet replay rate into PostHog. — content/src/content/index.ts:454-474
The DOM diagnostic is controlled by domFailureCaptureEnabled from the server configuration. — content/src/content/index.ts:276-316
Remote rtcCaptureMode, kill switch, and sample rate decide which meetings get the WebRTC capture path. — content/src/content/index.ts:662-805
Records all trial sessions and a remotely chosen proportion of other Meet sessions. — content/src/common/posthog-content.ts:279-313
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Documents the 145 MB lazy model download and initializes Xenova/whisper-base with WebGPU or WASM. — content/src/content/experiments/languageDetect.ts:1-20,188-247
Runs the sampling loop after the feature starts and processes repeated audio clips. — content/src/content/experiments/languageDetect.ts:119-147,281-310
Gates the feature on the server-backed dynamicLanguageSwitching account setting and active transcription. — content/src/content/toolbar/toolbar.tsx:416-461
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
DOM processing focused on meeting transcript, chat, and participant panels; no form manipulation identified. — content/content.js:2
Intercepts WebRTC channels and one fetch; no form element or action attribute modification. — inject-rtc.js:1