Is Google Photos Album to PDF photo book safe?
We analyzed Google Photos Album to PDF photo book version 3.2.0's actual code and gave it a 82/100 trust score. This is a purpose-aligned Google Photos…
Bottom line
This is a purpose-aligned Google Photos PDF tool with medium access risk, no established abuse, and no major security weakness found.
What it can access
It can read private photos visible in Google Photos and retrieve their images, with access limited to Google domains for the PDF feature [Q1][Q4].
Security weaknesses
No major security weakness was found; remote code execution and ordinary-website access to privileged features were not evidenced [Q7][Q11][Q21].
Signs of misuse
No evidence shows tracking, hidden collection, publisher uploads, or remote commands; Google image requests support the requested PDF feature [Q6][Q12][Q16][Q17].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, activeTab, tabs, scripting, and access to Google Photos and Google image hosts. Those powers support album extraction and image retrieval, though tabs/scripting also let it reload and reinject into the active album page.
Declares storage, activeTab, tabs, scripting, a photos.google.com content script, and host access limited to Google Photos and Googleusercontent image domains. — manifest.json:1-58
Which websites can it run on, and can it read or change what appears on those pages?
It runs only on Google Photos, where it reads album/photo tiles and selection state and scrolls the page during user-requested extraction. In all-photos mode it also reloads the tab first.
Parses album/share URLs, selected tile state, photo IDs, page URLs, thumbnail URLs, and high-resolution image URLs from the Google Photos DOM. — content.js:65-188
Auto-scrolls the album and repeatedly scans newly loaded photo tiles after START_EXTRACT. — content.js:222-313
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
DOM extraction targets photo links, tile backgrounds, and selected-photo checkboxes. — content.js:101-188
The content script is restricted to photos.google.com rather than general form-bearing websites. — manifest.json:1-58
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can access private photos and album metadata visible in the user's signed-in Google Photos session and retrieve the corresponding images with that session. It has no cookies, history, bookmarks, or downloads permission.
Fetches requested Google image URLs with credentials: include and converts the response to a data URL. — background.js:1-21
Collects identifiers and URLs for photos exposed in the signed-in album UI. — content.js:145-188
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the permissions associated with device hardware, clipboard, management, or native applications. — manifest.json:1-58
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends authenticated image requests to Google-hosted photo URLs so it can build the PDF and opens the publisher's purchase page only after a Buy click. No album or photo upload to the publisher was found.
The only first-party fetch downloads the requested image from a host allowed by the manifest and returns it internally as a data URL. — background.js:3-21
The explicit purchase action opens https://onlinegratis.net/buy/gphotos-pdf.php. — popup.js:1580-1582
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Fetched responses are read as image blobs and converted to data URLs. — background.js:3-21
Loads only the packaged jsPDF library and packaged popup.js. — popup.html:258-259
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After the user starts all-photo extraction, it reloads the active album while bypassing cache and then automatically scrolls and fetches photos until done. The behavior is visible and directly tied to the requested export.
Reloads the active album for all-photo mode, starts extraction, caches previews, and reports progress. — popup.js:392-475
Scrolls and scans until the album reaches a stable bottom or the configured maximum. — content.js:222-313
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, privacy, search, management, or URL-override capability. — manifest.json:1-58
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The first-party extraction and network code is readable, but the large packaged jsPDF 2.5.1 dependency is minified and substantially harder to inspect. It is an identifiable PDF library, not disguised first-party behavior.
Identifies itself as jsPDF 2.5.1 and contains the bundled minified PDF implementation. — lib/jspdf.umd.min.js:1-50
The security-sensitive authenticated fetch path is short readable source outside the library. — background.js:1-36
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Direct execution-sink searches and manual review found no text-to-code call. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses an album:<albumKey> chrome.storage.local record containing savedAt, albumUrl, and the complete items array. — popup.js:186-225
Adds base64 thumbnail data to each photo item and repeatedly saves the growing cache. — popup.js:333-354
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Endpoint and storage review found Google photo requests, a purchase URL, local settings, and album caches but no telemetry transport or identifier. — inventory.json:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends requests carrying the user's Google session to Google-hosted image URLs and reads the returned private photo content. No session token or photo content is sent to the publisher.
Uses fetch(url, {credentials: 'include'}) and reads the response as a Blob/data URL. — background.js:3-21
Host permissions limit these fetches to Google Photos and Googleusercontent photo hosts. — manifest.json:25-30
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests no clipboard or capture permission. — manifest.json:1-58
Collects photo tile URLs and identifiers, not keystrokes or screenshots. — content.js:162-188
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Handles only the internal FETCH_IMAGE_DATAURL message. — background.js:24-36
Handles only internal PING, START_EXTRACT, and STOP_EXTRACT messages. — content.js:316-370
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Reads and scrolls photo tiles but does not alter their links or insert monetized content. — content.js:1-371
Binds the fixed purchase URL solely to btnPurchase. — popup.js:1580-1612
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:1-58
Uses tabs.reload for extraction setup and jsPDF.save for the requested local PDF. — popup.js:317-330,1359-1367
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission and its host access is limited to named Google domains. — manifest.json:1-58
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Converts fetched image Blobs into data URLs and passes them to image/PDF processing. — background.js:3-21
Loads those data URLs as Image objects and embeds raster output in a PDF. — popup.js:935-1367
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes only backgrounds/* assets and declares no externally_connectable messaging. — manifest.json:41-50
Uses chrome.runtime.onMessage in the isolated extension content-script world, not window.postMessage or page events. — content.js:316-370
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The local pro flag changes watermark state only. — popup.js:1519-1542
Checks proUnlocked solely before adding the demo watermark to PDF pages. — popup.js:1220-1228,1353-1353
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Resource-intensive image rasterization and PDF generation run only inside the explicit saveAsPdf workflow with progress updates. — popup.js:935-1367
The background worker only fetches requested images and keeps a bounded in-memory cache. — background.js:1-36
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The only page interactions are querying photo/checkbox elements and scrolling the album container. — content.js:101-188,244-268