Is Zoho CRM for Gmail safe?
We analyzed Zoho CRM for Gmail version 1.3.14's actual code and gave it a 52/100 trust score. This is a purpose-aligned CRM helper with substantial access…
Bottom line
This is a purpose-aligned CRM helper with substantial access to private Gmail content and authentication-related data.
What it can access
It can read full opened Gmail messages, selected text, and contact details, then use Gmail and Zoho account access for CRM features.[Q1][Q3][Q14]
Security weaknesses
Authentication-related data is stored in extension storage, while page injection and broad CRM access increase the impact of a compromise.[Q2][Q4][Q14]
Signs of misuse
The package sends message participants, account-related data, and activity telemetry to Google, Zoho, and InboxSDK; this is partly feature-related but not fully minimal.[Q6][Q8][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests Gmail/Zoho site access, identity, tabs, activeTab, scripting, unlimited storage, and normal storage. Those powers support a Gmail-to-CRM integration but expose private communications, OAuth identity, CRM records, and the ability to inject an interface into a user-selected page.
Declares identity, tabs, activeTab, scripting, storage, unlimitedStorage, Gmail injection, and many Zoho service origins. — manifest.json:permissions, host_permissions, and content_scripts
Which websites can it run on, and can it read or change what appears on those pages?
It runs throughout mail.google.com and adds a Zoho sidebar, contact bubbles, and CRM controls. If the user enables all-page mode and clicks the toolbar, it can also inject a packaged sidebar into the currently selected page under activeTab permission.
Loads InboxSDK, jQuery, security helpers, and app.js on Gmail. — manifest.json:content_scripts
Injects commonapp.js and supporting scripts into the active tab when allPageEnabled is set. — js/bground.js:action.onClicked
Adds a fixed Zoho iframe/sidebar to the selected page. — app/commonapp.js:sidebar construction
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads complete opened email bodies, sender and recipient details, selected text, and Gmail compose data. Email content can include passwords, financial details, private messages, signatures, and form-like data even though the code uses it for CRM extraction.
Reads MessageView body innerHTML, converts it to text, and collects sender and recipient identities. — app/app.js:msgView
Reads selected Gmail text and recognizes email addresses. — app/app.js:mouseup handler
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores Gmail account associations, plain-text message content, extracted contact data, CRM metadata, users, organizations, records, settings, and OAuth state in extension storage. It does not request Chrome cookies, history, bookmarks, or downloads.
Persists the current/previous message text, sender information, and account matching state locally. — app/app.js:emailChecks and extractFormData storage
Reads numerous CRM record and metadata collections from local or sync storage. — app/db_service.js:storage service
Requests storage and unlimitedStorage but not cookies, history, bookmarks, or downloads. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
The identity permission lets it request Google OAuth tokens for the signed-in account. It has no file, location, camera, microphone, clipboard, screen-capture, native-app, or localhost access.
Requests identity with the Google userinfo.email scope. — manifest.json:oauth2 and permissions
Calls chrome.identity.getAuthToken interactively or silently. — js/bground.js:getAuthGat, getGat, and getOneTimeGat
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends Google tokens, Gmail addresses, CRM searches/records, organization identifiers, user IDs, and feature events to Google and Zoho services. InboxSDK separately sends hashed-email/session activity and error reports to services.inboxsdk.com and a Google Pub/Sub topic.
Transmits tokens and authenticated CRM/API requests to Google and Zoho services. — js/bground.js:getOneTimeGat, getZat, apiCall, and pushStats
Automatically queries Zoho Contacts using the opened message's sender address. — app/app.js:msgViewExt
Posts error reports to InboxSDK and queued event data through Google Pub/Sub. — app/inboxsdk.js:sendError and _trackEvent
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Sets extension-page script-src to self. — manifest.json:content_security_policy
Returns remote responses as text for callers to parse as CRM data. — js/bground.js:apiCall
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On installation it reloads existing Gmail tabs or opens Gmail. While signed in, opening a message triggers local extraction, a Zoho contact search, feature telemetry, and InboxSDK events without a separate per-message confirmation; record creation and email composition remain user-facing actions.
Reloads all Gmail tabs or creates a Gmail tab on installation. — js/bground.js:runtime.onInstalled
Processes opened messages and initiates contact lookup automatically. — app/app.js:registerMessageViewHandler and msgViewExt
Periodically sends queued SDK activity events. — app/inboxsdk.js:event queue flush
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No settings override, proxy, management, or download permission is declared. — manifest.json:top-level fields
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior spans roughly 9 MB of packaged InboxSDK, Angular, jQuery, CRM UI, security, and compatibility code. First-party flows are readable, but the size and multiple older libraries make complete inspection difficult.
Lists multi-megabyte InboxSDK/page-world code and many application/library files. — inventory.json:files
Includes an older minified Angular runtime. — lib/angular.1.4.3.min.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
Packaged dependencies use eval and new Function: an old date picker evaluates its own boolean data flag, Angular and Underscore compile packaged expressions/templates, and InboxSDK generates fixed wrappers. I found no path where fetched server text is passed into these sinks.
Calls eval on c.data('is'), an internal boolean/data value. — lib/glDatePicker.min.js:calendar initialization
Uses new Function to compile Angular expressions when CSP permits. — lib/angular.1.4.3.min.js:expression compiler
Uses new Function with fixed wrapper source built from a packaged function signature. — app/inboxsdk.js:__ud_wrapper generation
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Builds events with sessionId, emailHash, origin, versions, event name, and properties. — app/inboxsdk.js:_trackEvent
Publishes accumulated events about every two minutes when activity exists. — app/inboxsdk.js:logger master queue flush
Does it create a persistent ID or browser fingerprint to recognize you?
InboxSDK creates a session ID and a deterministic SHA-256 hash of the user's email (salted with a fixed inboxsdk prefix) for event telemetry. This can recognize the same account across sessions without sending the plain address to InboxSDK.
Computes emailHash and attaches it with sessionId to tracked events. — app/inboxsdk.js:hashEmail and _trackEvent
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends a Google OAuth token to Google's token-info services and Zoho's gadget service, receives a Zoho OAuth access token, and stores that token plus organization data in Chrome sync storage. It also sends message participant email addresses to Zoho contact searches.
Places the Google token in tokeninfo and Zoho gadget query URLs and receives resp.zat. — js/bground.js:getOneTimeGat and getZat
Stores zatAuthenticated and gatAuthenticated objects through chrome.storage.sync. — js/bground.js:toStore
Builds Zoho contact searches from the opened message's sender email. — app/app.js:msgViewExt
Does it record typing, form entries, clipboard contents, or screenshots?
It reads selected text in Gmail and automatically reads entire opened email bodies, senders, and recipients. It does not globally log keystrokes or capture clipboard, screenshots, camera, or microphone data.
Reads window selection and MessageView body/participant data. — app/app.js:mouseup and msgView
No clipboard or capture permission is declared. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable entry exists. — manifest.json:top-level fields
Handles internal extension/content-script requests and returns remote responses as data. — js/bground.js:runtime.onMessage
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates Zoho CRM interaction elements tied to contacts and messages. — app/app.js:sidebar and bubble UI
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission is declared. — manifest.json:permissions
Creates direct fetch requests to allowed Google/Zoho endpoints. — js/bground.js:apiCall
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or loopback host is declared. — manifest.json:permissions and host_permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Injects the packaged app/pageWorld.js file into Gmail's main world. — js/bground.js:inboxsdk__injectPageWorld handler
Dynamic functions are constructed from packaged fixed source rather than fetched content. — app/inboxsdk.js:dynamic wrapper code
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes many packaged UI resources to https://*/* but declares no externally_connectable origins. — manifest.json:web_accessible_resources
Embeds packaged extension HTML through chrome.runtime.getURL after a user toolbar action. — app/commonapp.js:sidebar iframe
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Selects fixed Zoho regional endpoints based on the authenticated data center. — js/constants.js:API_URLS
Uses visible options for popup and all-page modes. — js/settings.js:options handling
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Work is driven by Gmail message views, selections, and CRM UI interactions. — app/app.js:Gmail handlers
Does it change form fields or where a form sends its information?
When the user chooses to email a CRM contact, it opens a new Gmail compose view and fills the To recipient. The bundled InboxSDK can manipulate other compose fields, but the reviewed Zoho call site uses only setToRecipients; it does not change a website form action.
Calls sdk.Compose.openNewComposeView and setToRecipients with the selected CRM email address. — app/app.js:openGmailComposeWindow case
Triggers the compose action from a visible CRM contact control. — js/contact-info.js:openGmailComposeWindow