Is Google Sheets Tabs on top safe?
We analyzed Google Sheets Tabs on top version 1.1.8's actual code and gave it a 94/100 trust score. This appears to be a narrowly scoped, purpose-aligned…
Bottom line
This appears to be a narrowly scoped, purpose-aligned extension with no evidence of data collection or abuse.
What it can access
It can automatically change what appears on Google Sheets pages, including all frames, which fits its navigation purpose but still grants page-reading and page-changing access there [Q1][Q2][Q3][Q14].
Security weaknesses
No meaningful weakness was found: it has no text-to-code execution, external message channel, exposed files, or form-changing behavior [Q11][Q16][Q21][Q24].
Signs of misuse
There is no evidence of sending information away, downloading instructions, tracking visits, or collecting credentials or page contents [Q6][Q7][Q12][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects at document_start into all frames on https://docs.google.com/spreadsheets/*. It requests no named Chrome permissions or broader host access.
Declares the single Google Sheets content-script match, document_start, and all_frames. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It changes Google Sheets layout by moving the existing tab bar before the editor container, setting its z-index, or swapping two rows in preview mode. It also adds one meta marker to avoid duplicate application.
moveToTop performs the fixed insertBefore operations and marker/z-index updates. — scripts/content.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
All selectors target grid-bottom-bar, docs-editor-container, preview tbody/rows, and the extension marker. — scripts/content.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads window.location.pathname only to select editable/create/grading versus preview behavior. It does not read full URLs, tab lists, cookies, history, bookmarks, or downloads.
Factory splits location.pathname and checks fixed path words. — scripts/content.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No named permissions or device/native capabilities are declared. — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Complete runtime contains no fetch, XMLHttpRequest, WebSocket, beacon, image request, or form submission. — scripts/content.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Complete logic is packaged locally. — scripts/content.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It runs automatically on matching Google Sheets pages, but its only automatic action is the advertised layout change after the target page appears.
Content script runs automatically at document_start. — manifest.json:1
After the bounded wait, it applies the tab move once. — scripts/content.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No privileged configuration permissions. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Shows the tiny content bundle and duplicate small modules. — inventory.json:complete file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses window.setTimeout(u, 20) with a function callback; no text-to-code sink. — scripts/content.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads pathname solely for mode selection. — scripts/content.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Complete runtime contains no identity or telemetry logic. — scripts/content.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or web-request permissions. — manifest.json:1
No credential or session APIs. — scripts/content.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No event listeners or capture/input-reading code; only selector polling and DOM movement. — scripts/content.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no messaging API or message event listener. — scripts/content.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
DOM mutations are limited to existing Google Sheets layout nodes and an inert meta marker. — scripts/content.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No network-interception permissions. — manifest.json:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No network/native communication code. — scripts/content.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses querySelector/getElementById and insertBefore on existing nodes. — scripts/content.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or web_accessible_resources declaration. — manifest.json:1
No message or page bridge. — scripts/content.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Factory checks fixed path segments and selects one of two fixed movers. — scripts/content.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
waitElementRender uses a 20 ms function timer with a 30,000 ms deadline. — scripts/content.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No form/input selectors, value assignments, submit handlers, or action changes. — scripts/content.js:1