Is HubSpot Sales safe?
We analyzed HubSpot Sales version 3.2.1.43974's actual code and gave it a 66/100 trust score. HubSpot Sales is a legitimate-looking CRM tool with useful…
Bottom line
HubSpot Sales is a legitimate-looking CRM tool with useful Gmail features, but its broad access and ability to read and alter email warrant caution.
What it can access
It can read Gmail messages and drafts and use cookies for HubSpot operation [Q3][Q4], while requesting access across all websites beyond its stated Gmail, Calendar, and HubSpot features [Q1].
Security weaknesses
A message bridge does not verify the sender's website origin, so code already running in Gmail could potentially alter or send drafts through the extension [Q21].
Signs of misuse
The extension sends email and tracking information to HubSpot and modifies Gmail drafts for its advertised CRM features, with no unrelated recipient or covert misuse established [Q6][Q17].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The manifest grants tabs, cookies, scripting, declarative request rules and all-site host access, although packaged defaults and local allowlists narrow where optional everywhere features run.
Requests cookies, tabs, scripting and *://*/* host access; management and clipboardWrite are optional. — manifest.json:9-29
The optional everywhere script requires login, a local allowlist match and no blocklist match. — SignalsExtension/js/utils/tabs.ts:142-187
The packaged default allowlist contains Gmail only, not all other websites. — sales-ext-common/js/constants/chromeStorage.ts:2-14
Which websites can it run on, and can it read or change what appears on those pages?
It reads and augments Gmail and Calendar page interfaces to provide CRM, compose, tracking and sidebar features.
Declares content scripts for HubSpot pages, Gmail and Google Calendar. — manifest.json:49-80
Extracts the visible body HTML/text from a Gmail message view. — sales-ext-gmail/js/message/extractBody.js:7-30
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read sensitive email bodies, subjects, senders and recipients; the confirmed uses are HubSpot CRM, templates, associations and tracking.
Builds a message object containing subject, extracted body and sender. — sales-ext-gmail/js/message/getMessageFromMessageView.js:5-9
Shares active draft body, subject, signature, selected text and recipients with the active HubSpot modal. — sales-ext-gmail/js/gmail/compose/PreloadedPostMessageAdapter.js:35-51
Logging and tracking actions run according to per-compose state and user/account defaults. — sales-ext-gmail/js/gmail/compose/asyncSendHandler.js:215-239
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It uses extension storage for HubSpot account state, configuration, logs and feature preferences and reads HubSpot cookies; no Chrome browsing-history permission is present.
Declares storage and cookies but not history or browsingData. — manifest.json:9-29
Copies HubSpot CSRF and cookie-expiry state into local extension storage. — SignalsExtension/js/background/csrfCookieMonitor.js:136-178
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
Clipboard writing and installed-extension inventory are optional and requested for specific user-facing features; no camera, microphone or file-system permission is declared.
management and clipboardWrite are optional permissions. — manifest.json:24-29
An explicitly generated support email can include the installed-extension inventory supplied after management permission. — sales-ext-gmail/js/actions/SendDebugLogActions.js:72-85
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends email tracking/association metadata, CRM requests, usage analytics and performance telemetry to HubSpot, the advertised service; no unrelated recipient was found.
Posts tracker data to HubSpot's tracking/write endpoint. — sales-ext-gmail/js/apis/TrackingApi.js:20-33
Sends subject, sender, recipients and Gmail identifiers to a HubSpot association RPC when a portal/user is present. — sales-ext-gmail/js/actions/EmailAssociationActions.js:35-70
Posts extension resource timings, session ID and portal ID to HubSpot's cartographer endpoint; sensitive URL parameters are redacted at lines 347-377. — SignalsExtension/js/init/PerformanceTelemetry.ts:335-405
Does it download or run code, settings, or instructions supplied by a remote server?
HubSpot remotely supplies selectors, styles, tracking regexes and feature overrides; these values steer packaged behavior but are not executed as JavaScript.
Fetches Gmail/Calendar selectors, styles and email-tracking regular expressions from HubSpot endpoints. — sales-ext-common/js/apis/configApi.ts:32-157
Refreshes feature overrides hourly and uses them to enable, disable or gate packaged features. — sales-ext-common/js/managers/featureToggles.ts:64-105
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Logged-in operation initializes analytics, cookie monitoring, configuration refresh and page integrations automatically; email modification occurs only when the corresponding logging/tracking state is enabled.
Startup initializes HubSpot cookies, account state, anonymous analytics and optional performance telemetry. — SignalsExtension/js/init/initServiceWorker.js:27-75
The send path checks isLogged and isTracked before adding logging or tracking behavior. — sales-ext-gmail/js/gmail/compose/asyncSendHandler.js:203-254
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, browserSettings, privacy, search or management-by-default permission. — manifest.json:9-29
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The shipped bundle is minified. — js/gmail.js:1-51
The package includes source names and full sourcesContent for the Gmail bundle. — js/gmail.js.map:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Underscore's template compiler constructs a function from a template string. — underscore/index.js:1589-1604
Ably includes a global-object fallback using new Function with a constant string. — ably/index.js:3529-3541
Extension pages allow only self scripts; unsafe-eval appears only in an unused sandbox policy and no sandbox page is declared. — manifest.json:39-42
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Queries tabs and conditionally injects a packaged script after login. — SignalsExtension/js/init/everywhereListener.ts:43-58
Uses URL, window type, local allowlist and blocklist to decide injection. — SignalsExtension/js/utils/tabs.ts:142-187
Does it create a persistent ID or browser fingerprint to recognize you?
It runs HubSpot usage/error/performance analytics with session and account identifiers; this is service telemetry, not evidence of covert cross-site surveillance.
Starts an unauthenticated usage tracker on startup before account initialization. — SignalsExtension/js/background/initAnonymousTracker.js:3-13
Reports a random session ID, portal ID and performance logs to HubSpot. — SignalsExtension/js/init/PerformanceTelemetry.ts:389-405
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads and monitors HubSpot session/CSRF cookies for HubSpot authentication; no path reads Gmail or unrelated-site cookies.
Targets named cookies only when their domain matches the configured HubSpot API domain. — SignalsExtension/js/background/csrfCookieMonitor.js:85-95
Fetches only HubSpot's CSRF and hubspotapi cookies. — SignalsExtension/js/background/csrfCookieMonitor.js:139-178
Does it record typing, form entries, clipboard contents, or screenshots?
It observes draft changes and reads compose/message fields, but the confirmed state broadcast contains recipients and subject rather than individual keystrokes or passwords.
On recipient, subject or body changes, a debounced handler broadcasts active state containing recipients and subject. — sales-ext-gmail/js/listeners/composeContextBridge.ts:34-60
Explicit feature actions can read subject, body and sender from the active compose view. — sales-ext-gmail/js/message/getMessageFromComposeView.js:3-7
Can a website or remote server send commands that make the extension take actions?
HubSpot pages and services can supply CRM content, templates and draft instructions that packaged handlers apply inside Gmail; access is tied to HubSpot origins/accounts rather than an arbitrary public command server.
External connection matches are limited to HubSpot production and QA domains. — manifest.json:30-38
Packaged handlers can insert links/HTML, set subject/body, toggle logging/tracking and send the draft. — sales-ext-gmail/js/gmail/compose/PreloadedPostMessageHandlers.js:49-163
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It intentionally modifies Gmail drafts by adding CRM BCC recipients, tracking pixels, wrapped links, templates and HubSpot-generated draft content.
Adds configured HubSpot CRM BCC addresses when logging is enabled. — sales-ext-gmail/js/listeners/formlessTracking.js:70-78
Obtains tracking artifacts, wraps links and inserts a tracking pixel when tracking is enabled. — sales-ext-gmail/js/listeners/handleTrackingAsync.ts:128-193
Packaged background messages can insert a body or populate a draft through the Gmail compose SDK. — sales-ext-gmail/js/listeners/composeContextBridge.ts:98-177
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It uses declarative request rules to prevent the user's own tracking pixels/links from counting as opens or clicks and intercepts Gmail requests needed for tracking metadata.
Blocks the user's own open tracker and unwraps the user's own click tracker. — SignalsExtension/js/background/requestBlocker.js:59-75
Installs packaged declarative rules; no server-supplied rule code is used. — SignalsExtension/js/background/requestBlocker.js:185-220
Packaged Gmail interceptor extracts HubSpot tracking/association markers from outgoing message data. — js/xhrInterceptor.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:9-29
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote values are JSON selectors, styles, regexes and feature status. — sales-ext-common/js/apis/configApi.ts:32-210
Dynamic injection always loads the packaged js/everywhere.js file. — SignalsExtension/js/init/everywhereListener.ts:14-36
Extension pages enforce script-src self without unsafe-eval. — manifest.json:39-42
Can ordinary websites access privileged extension features through messaging or exposed files?
A Gmail modal postMessage bridge checks a sender label and later pins the source window, but it does not validate incoming origin; spoofing requires code or an iframe already running in Gmail while the modal is active.
Accepts window messages based on data.sender, then filters later messages by the initial source window without checking event.origin. — sales-ext-gmail/js/gmail/compose/PreloadedPostMessageAdapter.js:18-33
Replies are restricted with a HubSpot target origin, which prevents a non-HubSpot source from receiving compose data. — sales-ext-gmail/js/gmail/compose/PreloadedPostMessageAdapter.js:54-64
Accepted modal commands can modify and send a Gmail draft. — sales-ext-gmail/js/gmail/compose/PreloadedPostMessageHandlers.js:61-163
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads and writes local website allowlist/blocklist settings. — sales-ext-common/js/utils/everywhereWebsiteSettings.ts:28-53
Refreshes HubSpot feature status hourly and gates packaged features. — sales-ext-common/js/managers/featureToggles.ts:64-105
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background initialization covers account, CRM and telemetry services rather than compute workloads. — SignalsExtension/js/init/initServiceWorker.js:27-75
Does it change form fields or where a form sends its information?
It can change recipients, subject and message body and trigger sending within Gmail for explicit HubSpot workflows; no code changes an arbitrary webpage form action to an unrelated destination.
Handles HubSpot modal commands that insert content, set subject/body, adjust state and send a Gmail message. — sales-ext-gmail/js/gmail/compose/PreloadedPostMessageHandlers.js:49-163
Adds only configured CRM BCC recipients to the Gmail compose view when logging is enabled. — sales-ext-gmail/js/listeners/formlessTracking.js:70-78