Is Excel to Google Sheets safe?
We analyzed Excel to Google Sheets version 1.3's actual code and gave it a 72/100 trust score. This extension fits its file-conversion purpose but has…
Bottom line
This extension fits its file-conversion purpose but has unnecessarily broad webpage access and can misdirect dropped spreadsheets.
What it can access
It runs on every webpage and reads complete spreadsheets deliberately dropped there, then sends them to Google Drive for conversion, which fits the feature but is broader than necessary.[Q1][Q2][Q5][Q6]
Security weaknesses
Global drag-and-drop interception can cancel a site's normal handling and send a spreadsheet to Google instead of the site's intended destination.[Q2][Q8][Q24]
Signs of misuse
No evidence shows tracking, publisher collection, remote control, or unrelated destinations; uploads go to Google Drive for the stated conversion feature.[Q6][Q7][Q12][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It asks to run a page access on every webpage and to obtain a Google OAuth identity token with drive.file scope. Uploading to Sheets explains identity access, but every-site execution is broader than necessary for a dedicated upload surface.
Requests identity, injects content.js on <all_urls>, and declares the Google drive.file OAuth scope. — manifest.json:12-38
Which websites can it run on, and can it read or change what appears on those pages?
It runs on every site, watches document-level drag/drop events, reads dropped spreadsheet files, suppresses the page's normal drop action, and inserts an error notice when needed. It does not otherwise inspect page text or forms.
Registers document drop and dragover listeners, inspects dropped filenames, and stops default handling and propagation. — content.js:1-34
Creates a temporary on-page error notification if an upload cannot proceed. — content.js:37-56
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Only reads File objects from event.dataTransfer.files when matching spreadsheet filename suffixes are present. — content.js:1-29
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The only named Chrome permission is identity. — manifest.json:12-16
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads the complete contents of local Excel or CSV files that the user drops onto a webpage. It cannot browse arbitrary files and has no clipboard, camera, microphone, location, screen, or native-app capability.
Uses FileReader.readAsBinaryString on the dropped File and base64-encodes the complete result. — content.js:59-83
Declares only identity, with no device, clipboard, media, location, capture, or nativeMessaging permission. — manifest.json:12-14
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the dropped file's name, type, and complete contents directly to Google's Drive upload services so the file can be opened as a Google Sheet. No publisher or analytics destination was found.
Builds a multipart request containing file metadata and base64 data and POSTs it to https://www.googleapis.com/upload/drive/v3/files. — background.js:23-61
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Parses the Drive API JSON response and either reports an error or opens the returned spreadsheet ID. — background.js:57-80
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically attaches global drag/drop handlers on every site. A matching file drop triggers the upload flow and overrides the site's own handling, although the file selection itself is an explicit user action and OAuth is interactive.
The listeners activate without an extension-button click and stop page behavior for matching drops; dragover is always canceled. — content.js:1-34
An uploadFile message calls chrome.identity.getAuthToken with interactive: true before upload. — background.js:7-18
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no settings override, management, proxy, privacy, or debugger capability. — manifest.json:1-40
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Lists only 23,756 unpacked bytes, with three small JavaScript files and static popup/icon assets. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The extension-page CSP permits only packaged self scripts. — manifest.json:33-35
The complete worker contains fixed message, OAuth, upload, and tab-opening logic without dynamic execution. — background.js:1-84
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses only dropped File objects and runtime messaging; it never reads location, document URL, title, links, or navigation state. — content.js:1-83
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no identifier generation, local persistence, analytics, or telemetry logic. — background.js:1-84
Does it send cookies, session details, authentication data, or page contents elsewhere?
The complete dropped file and an OAuth bearer token are sent to Google's Drive services. The token is also printed to the extension's background developer console, but no code transmits it to the publisher or another site.
Obtains an interactive OAuth token and logs the token with console.log before uploading. — background.js:7-16
Places base64 file contents in the multipart body and the OAuth token in the Authorization header to googleapis.com. — background.js:43-61
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers only drop and dragover events and contains no keyboard, input, change, paste, clipboard, media, or capture listener. — content.js:1-83
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry or web-accessible executable resource. — manifest.json:1-40
Handles only the internal uploadFile runtime message and forwards its file fields to the fixed upload routine. — background.js:7-26
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Constructs a docs.google.com/spreadsheets URL from the Drive response ID and opens it in a tab. — background.js:62-75
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, webRequest, declarativeNetRequest, debugger, or downloads permission. — manifest.json:12-14
The Authorization and Content-Type headers belong only to the extension's own fixed Google Drive fetch. — background.js:53-61
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
The only network destination is the HTTPS Google Drive upload API. — background.js:1-84
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
btoa encodes FileReader output and sends it as the base64Data field, which is placed directly in a multipart upload rather than executed. — content.js:59-72
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines neither web_accessible_resources nor externally_connectable. — manifest.json:1-40
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches only on dropped filename suffix and upload error state, not site or user targeting. — content.js:1-83
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work consists only of clearing cached auth tokens on install and handling user-triggered uploads. — background.js:1-84
Does it change form fields or where a form sends its information?
It does not rewrite form actions or typed values, but it globally cancels dragover and intercepts matching file drops before the host page can handle them. A spreadsheet dropped onto another site's upload control can therefore be sent to Google Drive instead of that site.
Calls preventDefault and stopPropagation for spreadsheet drops and for every dragover event at document scope, then starts its own file upload. — content.js:1-34