Is Transfer Google Drive to Onedrive safe?
We analyzed Transfer Google Drive to Onedrive version 2.2.0's actual code and gave it a 68/100 trust score. The extension appears purpose-aligned but…
Bottom line
The extension appears purpose-aligned but carries meaningful access and webpage-injection risks.
What it can access
It runs on several cloud-storage sites and reads a MultCloud account cookie, which is meaningful access but supports its transfer feature.[Q1][Q2][Q4]
Security weaknesses
Server-provided file names and paths are inserted into the extension’s interface without safe escaping, creating a webpage-injection risk.[Q10][Q20]
Signs of misuse
The package shows transfer data and session-backed requests going to its own MultCloud service, but no unrelated collection, tracking, or remote code execution.[Q6][Q7][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests cookie access for MultCloud and automatically runs page access on five cloud-storage services. These powers support its workflow, but expose a valuable authenticated session and sensitive cloud-account pages.
Declares cookies and MultCloud host access. — manifest.json:7-15
Injects jQuery plus service-specific scripts into Drive, Dropbox, OneDrive/SharePoint, iCloud and Google Photos. — manifest.json:26-65
Which websites can it run on, and can it read or change what appears on those pages?
It inspects cloud-service page structure, clones or creates controls, and inserts a MultCloud transfer button. It does not read or modify file contents.
Clones a Drive control, labels it for cloud transfer and opens a fixed MultCloud URL on click. — googleDrive.js:1-22
Reads OneDrive/SharePoint navigation DOM and inserts a fixed transfer control. — oneDrive.js:1-68
Polls iCloud page state and inserts controls into Photos or Drive toolbars. — icloud.js:3-56
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The service script reads toolbar structure and one email-label text that is then unused; it does not inspect fields. — googleDrive.js:1-22
Dropbox logic only locates and clones an action-bar button. — dropbox.js:1-18
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads the MultCloud `user` cookie and parses the encoded JSON account record. It does not request browser history, bookmarks or downloads.
Calls chrome.cookies.get for the app.multcloud.com `user` cookie, URL-decodes it and parses it into currentUser. — sign.js:5-16, 108-113
Cookie access is limited by host permissions to MultCloud origins; history, bookmarks and downloads are absent. — manifest.json:7-15
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Only cookies and three MultCloud hosts are privileged; no device permission is declared. — manifest.json:7-15
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the MultCloud account ID, request salt, task identifiers, cloud token IDs, paths, options and task-control commands to app.multcloud.com with session credentials. This is the first-party service the extension manages.
POSTs signed JSON to app.multcloud.com with withCredentials enabled. — api.js:9-29, 137-154
Builds requests containing currentUser.id plus task, drive, schedule and option data. — common_utli.js:5-82
Sends cancel, execute and update operations to the MultCloud task API after user actions. — tasks.js:1211-1277
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Decrypts API response data as JSON and returns it to fixed task-display/control logic. — api.js:91-105
Manifest V3 uses only packaged scripts and declares no remotely hosted executable resource. — manifest.json:1-65
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
page access automatically add transfer controls when supported cloud pages load, while task execution, cancellation and schedule changes require clicks in the popup.
Content scripts run automatically on matched cloud-service pages. — manifest.json:26-65
Execute/cancel and schedule-update functions are bound to explicit popup clicks. — sign.js:36-50, 78-95
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No settings, search or proxy permission is present. — manifest.json:7-15
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party logic is readable, but the package bundles obsolete minified jQuery 1.8.2 and a full CryptoJS distribution. More importantly, readable code builds HTML directly from server-returned names and paths.
Identifies itself as jQuery 1.8.2 and contains its generic script/globalEval machinery. — jquery.min.js:1
Constructs task-card HTML using unescaped task names and cloud paths from API objects. — tasks.js:886-987
Constructs detail HTML using unescaped source/destination paths and entity filenames. — tasks.js:619-760
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The bundled library defines globalEval and script converters as part of jQuery 1.8.2. — jquery.min.js:1
The sole application Ajax wrapper sets dataType to json and POSTs fixed MultCloud API paths. — api.js:9-29, 137-154
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Content-script matches are limited to Drive, Dropbox, OneDrive/SharePoint, iCloud and Google Photos. — manifest.json:26-65
The inserted button opens a fixed URL without adding the current page URL. — googleDrive.js:18-22
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Account identity comes from the user's existing MultCloud session cookie. — sign.js:5-16
MD5 values sign task requests; no identifier is created for analytics or cross-site tracking. — api.js:106-154
Does it send cookies, session details, authentication data, or page contents elsewhere?
Authenticated requests send MultCloud account and task data to MultCloud and include the site's session credentials. No cloud-site cookies, passwords or page contents are sent to unrelated domains.
Cross-origin API requests set withCredentials true for app.multcloud.com. — api.js:9-29
Reads the MultCloud user cookie locally to obtain account context. — sign.js:108-113
Cookie host access is confined to MultCloud origins. — manifest.json:10-15
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Cloud content scripts provide button injection only; no clipboard or capture permission is declared. — manifest.json:26-65
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Decrypts remote API JSON and passes it into fixed callbacks. — api.js:19-25, 91-105
Task-list response objects flow into HTML strings appended to the popup. — tasks.js:9-53, 886-987
Cloud filenames are concatenated into title attributes and element bodies without HTML or attribute escaping. — tasks.js:1134-1165
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Clones the action control, labels it Cloud Transfer and opens a fixed first-party MultCloud URL. — dropbox.js:5-17
Adds a Cloud Transfer item without changing existing navigation or search results. — googlePhotos.js:8-19
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads or proxy permission exists. — manifest.json:7-15
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Configured application endpoints are HTTPS MultCloud production hosts despite the misleading local_server variable name. — api.js:1-5
nativeMessaging is absent. — manifest.json:7-15
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
It decrypts every MultCloud services response with a hard-coded AES-ECB key and parses the plaintext as JSON. The result is treated as data, not code, but is later inserted into HTML without escaping.
Contains the Base64 AES key and decrypts hex ciphertext using AES-ECB/PKCS7 before JSON.parse. — api.js:7, 91-105
Decrypted response fields such as task names and paths reach HTML construction. — tasks.js:886-987
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No web_accessible_resources or externally_connectable declaration exists. — manifest.json:1-65
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The same fixed content scripts run on their declared cloud-service matches. — manifest.json:26-65
API behavior uses fixed endpoints and operations without remote feature flags. — api.js:1-154
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Schedules another progress request after six seconds while a transfer remains active. — tasks.js:169-215
Checks iCloud page location and toolbar state every three seconds. — icloud.js:1-10
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates or clones controls in OneDrive and SharePoint navigation. — oneDrive.js:12-68
Places remote task names and cloud paths into popup element bodies and attributes without escaping. — tasks.js:886-987, 1134-1165