Is Clickable Google Maps safe?
We analyzed Clickable Google Maps version 1.0.6's actual code and gave it a 92/100 trust score. This appears to be a narrowly focused Google Search helper…
Bottom line
This appears to be a narrowly focused Google Search helper with no demonstrated data collection or dangerous capabilities.
What it can access
It can read and change Google Search result pages across many regional domains, matching its Maps-link purpose but covering a broad set of Google Search pages [Q1][Q2].
Security weaknesses
The code is compact and somewhat harder to inspect, but reviewed behavior remains readable and no exposed privileged features were found [Q10][Q21].
Signs of misuse
No evidence shows tracking, outside data sharing, remote commands, or downloaded code; its automatic page edits are feature-related [Q6][Q7][Q12].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can access Google search-result pages across Google's regional domains, but no other sites and no browser permissions.
Lists only HTTPS Google /search?q=* content-script matches and no permissions array. — manifest.json:20-224
Which websites can it run on, and can it read or change what appears on those pages?
It reads Google search navigation and map-result elements and adds Maps links or buttons. It does not read arbitrary page content.
Queries navigation, map image, region, and complementary-result elements for the Maps UI. — src/entries/contentScript/primary/main.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads only search-query, navigation labels, and Google Maps hrefs. — src/entries/contentScript/primary/main.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares no browser permissions. — manifest.json:3-224
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no device or download permissions. — manifest.json:3-224
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Builds Maps hrefs and uses window.open without fetch, XHR, beacon, or WebSocket calls. — src/entries/contentScript/primary/main.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Contains fixed selectors, translations, and UI logic. — src/entries/contentScript/primary/main.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically adds Maps navigation when a matching Google search page loads. This is the advertised feature and sends no data.
Runs its four Maps UI restoration routines immediately. — src/entries/contentScript/primary/main.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no override or settings permission. — manifest.json:3-224
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The small scripts are minified, but their Maps-only logic is readable and there is no concealment suggesting harmful behavior.
Contains compact, named DOM functions and human-readable selectors/URLs. — src/entries/contentScript/primary/main.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses fixed DOM and URL APIs without text-to-code execution. — src/entries/contentScript/primary/main.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses URLSearchParams(window.location.search).get('q') and window.location.host. — src/entries/contentScript/primary/main.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains only Maps UI restoration code. — src/entries/contentScript/primary/main.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or identity permissions. — manifest.json:3-224
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers click handlers only on its Maps UI elements. — src/entries/contentScript/primary/main.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no network or message receiver. — src/entries/contentScript/primary/main.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It modifies Google results to add a Maps tab, clickable map image, overlay button, and missing Maps href. These edits match its stated purpose.
Clones a navigation item, adds Maps click handlers, creates an overlay button, and repairs a Maps anchor. — src/entries/contentScript/primary/main.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no network-control or download permissions. — manifest.json:3-224
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:3-224
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Imports only a packaged background bundle. — serviceWorker.js:1
Contains no remote resource loader. — src/entries/contentScript/primary/main.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Uses direct DOM listeners without runtime or window messaging. — src/entries/contentScript/primary/main.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Runs fixed Maps UI logic with no settings reads. — src/entries/contentScript/primary/main.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Performs bounded DOM queries and waits for Google UI elements. — src/entries/contentScript/primary/main.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Targets navigation anchors and map-result containers only. — src/entries/contentScript/primary/main.js:1