Is classroom.cloud Student safe?
We analyzed classroom.cloud Student version 3.10.0.0's actual code and gave it a 52/100 trust score. This is a powerful school-monitoring extension with…
Bottom line
This is a powerful school-monitoring extension with broad visibility into browsing, typing, screens, clipboard, and device details, so use is appropriate only in a clearly authorized classroom setting.
What it can access
It can monitor every website, typed or copied text, screens, browsing activity, clipboard, and detailed device information for classroom operations.[Q1][Q3][Q5][Q12]
Security weaknesses
Remote classroom connections can issue powerful predefined commands, while all-site access exposes sensitive page interactions if those controls or accounts are misused.[Q1][Q14][Q16]
Signs of misuse
The extension demonstrably collects browsing activity, typed or copied text, screenshots, and device identifiers for its school service, but no unrelated recipient or credential theft was established.[Q3][Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs page access in every frame of every site and requests a very broad set of browser, device, identity, clipboard, capture, and management permissions.
Declares broad permissions, <all_urls> host access, and all-frame content scripts on every URL. — manifest.json:15-62
Which websites can it run on, and can it read or change what appears on those pages?
It observes page URLs and titles and can capture the visible tab or full desktop; it does not demonstrate general page-text scraping.
Tracks tab URLs, titles, focus, and active time for filtering and activity monitoring. — js/models/tabs.js:1
Implements visible-tab capture and the desktop-capture chooser. — background.js:1
Processes a selected desktop media stream for screen sharing. — js/desktopCapture.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It processes typed and pasted text for configured safeguarding phrases and can send a matched phrase with nearby context and a screenshot.
Attaches key listeners to pages, inputs, text areas, editable elements, and accessible frames. — js/modules/content/keyHandlers.js:1
Reads copied or pasted text and forwards it into the safeguarding message path. — js/modules/content/clipData.js:1
Builds phrase-match alerts with surrounding text and optional screenshot evidence. — js/modules/background/esafety.js:1
Encrypts and submits safeguarding alerts to the configured classroom.cloud service. — js/modules/background/connection.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads extension storage and actively inventories installed Chrome applications and extensions; browser-history helpers exist but no caller was found.
Requests chrome.management.getAll data and builds an installed-software inventory. — js/models/software.js:1
Exposes storage and management APIs; its history search/delete handlers have no caller elsewhere in the package. — background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read and replace clipboard text, capture the visible tab or selected desktop, and save support logs through Chrome downloads.
Handles connected-controller clipboard read and write commands. — js/comms.nc.js:1
Implements screen capture, desktop media selection, clipboard permissions, and log downloads. — background.js:1
Consumes the browser-selected screen stream for classroom viewing. — js/desktopCapture.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends monitoring, safeguarding, registration, and inventory data to classroom.cloud regional services; no unrelated recipient was found.
Posts activity, safeguarding, and inventory records to classroom.cloud service endpoints. — js/modules/background/connection.js:1
Registers the enrolled device and retrieves its site policy and gateway configuration. — js/modules/cicregistration.js:1
Connects to the configured classroom gateway over WSS. — js/socket.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The school service remotely supplies monitoring flags, phrase lists, schedules, network restrictions, web filters, and gateway details.
Parses server configuration for activity monitoring, safeguarding, filtering, timing, IP ranges, and the classroom gateway. — js/modules/cicregistration.js:1
Loads managed enrollment settings and reacts to local or administrator policy changes. — js/settings.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Content listeners load automatically on every page, and configured monitoring and reconnect behavior can run without a fresh user action.
Loads the monitoring content scripts at document_idle in every frame of every URL. — manifest.json:47-63
Registers keyboard and focus listeners when the content module starts. — js/modules/content/keyHandlers.js:1
Starts reconnect and safeguarding workers on browser startup. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Does not request proxy, privacy, or browserSettings permissions. — manifest.json:15-42
Applies classroom web policy by evaluating and redirecting tabs rather than changing global browser settings. — js/modules/background/webFilter.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most application modules are production-minified into single lines, but their symbols and control flow remain readable; minification alone is not suspicious.
Large minified controller-protocol implementation retains readable method and command names. — js/comms.nc.js:1
Minified registration and configuration module retains identifiable policy fields and API flows. — js/modules/cicregistration.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Manifest V3 policy allows scripts only from the packaged extension. — manifest.json:89-92
Remote packets are dispatched through predefined command handlers rather than evaluated as JavaScript. — js/comms.nc.js:1
Does it track the websites, pages, searches, or links you visit?
It tracks visited URLs, page titles, focus, and active duration and can upload those records when website monitoring is allowed.
Maintains URL, title, status, and active-time data for tabs. — js/models/tabs.js:1
Submits website activity to the classroom.cloud activity-monitoring API. — js/modules/background/connection.js:1
Enables the upload only under configured monitoring, schedule, IP, license, and cloud-state conditions. — js/modules/cicregistration.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It processes persistent school, user, device, site, directory, serial, network, and session identifiers for enrollment and reporting.
Registers account, site, user, device, network, and organizational identity fields. — js/modules/cicregistration.js:1
Retrieves asset ID, hostname, serial number, hardware platform, and annotated location. — js/models/deviceinfo.js:1
Calls Chrome identity and enterprise device/network attribute APIs. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
Password inputs are not excluded from local keystroke inspection, but transmission is demonstrated only when configured safeguarding logic matches text; credential theft was not demonstrated.
Attaches to INPUT elements without checking or excluding type=password. — js/modules/content/keyHandlers.js:1
Creates an alert only when enabled phrase rules and triggering conditions match. — js/modules/background/phraseMatch.js:1
Builds the matched-text alert and surrounding context for submission. — js/modules/background/esafety.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It can observe keystrokes, copied or pasted text, visible-tab screenshots, and a browser-approved desktop stream.
Captures key events across page inputs and editable content. — js/modules/content/keyHandlers.js:1
Captures copy and paste text. — js/modules/content/clipData.js:1
Captures visible tabs and invokes Chrome's desktop-media chooser. — background.js:1
Processes the chosen screen stream and stops it when the sharing state ends. — js/desktopCapture.js:1
Can a website or remote server send commands that make the extension take actions?
An authenticated classroom session can issue predefined commands for viewing, clipboard exchange, tab operations, filtering, messaging, and device locking.
Creates a WSS connection to the enrolled classroom gateway. — js/socket.js:1
Establishes the controller connection and associated control role. — js/comms.commands.js:1
Dispatches predefined classroom commands for viewing, clipboard, tabs, filters, messages, and locking. — js/comms.nc.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Applies server-provided allow and block policy to browser navigation. — js/modules/background/webFilter.js:1
Handles controller plugin commands that manipulate tabs and approved website lists. — js/comms.nc.js:1
Executes the requested Chrome tab create, update, reload, mute, and remove operations. — background.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It makes HTTPS services requests, maintains a WSS classroom connection, and can download support logs; it does not configure a browser proxy.
Connects to a configured gateway using wss://. — js/socket.js:1
Sends monitoring and inventory requests to classroom.cloud endpoints. — js/modules/background/connection.js:1
Can invoke chrome.downloads.download for a user support log. — background.js:1
Can it communicate with software on the computer or services running on localhost?
It reads CPU, memory, storage, display, enterprise device, network, user, and installed-extension information; no native-messaging host is used.
Collects CPU, memory, storage, display, and graphics information. — js/models/hardware.js:1
Inventories installed Chrome applications and extensions. — js/models/software.js:1
Calls Chrome enterprise device and networking attribute APIs. — background.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads remote activity, safeguarding, filtering, timing, and gateway configuration. — js/modules/cicregistration.js:1
Maps gateway packets to packaged, predefined command handlers. — js/comms.nc.js:1
Manifest V3 extension pages permit only packaged scripts. — manifest.json:89-92
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares isolated content scripts and web-accessible files but no externally_connectable entry. — manifest.json:47-92
Uses chrome.runtime messaging from the isolated content-script context rather than a public page bridge. — js/modules/content/clientMessaging.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Loads managed account, site, region, acknowledgement, and monitoring settings. — js/settings.js:1
Calculates monitoring eligibility from remote flags, dates, times, IP restrictions, and cloud state. — js/modules/cicregistration.js:1
Provides accept and reject controls when the administrator enables connection acknowledgement. — js/modules/ui/connectionAcknowledgementDialog.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
CPU and graphics APIs are used for device inventory rather than computation. — js/models/hardware.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Builds script strings that edit the active field or dispatch text input. — js/keyboard.js:1
Builds a script string to focus or click the element at controller-supplied coordinates. — js/mouse.js:1
Attempts to run those strings with chrome.tabs.executeScript. — background.js:1
Declares a Manifest V3 service worker, where chrome.tabs.executeScript is not available. — manifest.json:44-45,92