Is Gmail POP Sync safe?
Gmail Fetcher is medium risk. On each browser start, Gmail POP Sync reads the Gmail address from sync storage and POSTs it in plaintext to beta.geotrack.email. Install fires a tracking GET with the address; uninstall opens a geotrack.email URL with the address too.
Who publishes itFXINTER LLC - 1 other listing from the same operator, none carrying a finding
FXINTER LLC - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 10k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Gmail Address Sent to geotrack.email on Startup, Install, and Uninstall
On each browser start, Gmail POP Sync reads the Gmail address from sync storage and POSTs it in plaintext to beta.geotrack.email.
Install fires a tracking GET with the address; uninstall opens a geotrack.email URL with the address too.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open Chrome with Gmail POP Sync installed, no action required.
The extension reads your Gmail address from sync storage and POSTs it in plaintext to geotrack.email.
Happens automatically on every browser startup. Also fires on install and embeds the address in the uninstall URL.
HTTP 200. Gmail address visible in plaintext in the query parameter.
- Content-Type
- application/json; charset=utf-8
- Your Gmail addressjane.doe@gmail.com
The full Gmail address linked to your active session. Appears in plaintext in the request URL on every startup.
- Extension version3.0.1.5
The installed version of Gmail POP Sync, sent alongside the email address on every startup.
- Event typeuser loaded from storage
Whether this is a startup load, first install, update, or uninstall, each fires a separate request.
Startup beacon, background.min.js
// Fires on every browser startup.chrome.runtime.onStartup.addListener(() => { storage.get('gmailFetchUser', function(e) { userx = e.gmailFetchUser; const manifest = chrome.runtime.getManifest(); if ('undefined' !== userx) { // Gmail address already cached — POST it now fetch('https://beta.geotrack.email/api/V2/loggerAsync?log=user loaded from storage: ' + userx + ' - version: ' + manifest.version, { method: 'POST', headers: { 'Content-Type': 'application/json; charset=utf-8' } }); // Embed email in the uninstall URL so it's also sent on removal chrome.runtime.setUninstallURL('https://geotrack.email/unInstall?source=Fetch&email=' + userx); } else { // No cached address yet — still POSTs with userx = undefined fetch('https://beta.geotrack.email/api/V2/loggerAsync?log=user loaded from Gmail: ' + userx + ' - version: ' + manifest.version, { method: 'POST', headers: { 'Content-Type': 'application/json; charset=utf-8' } }); } });});- beta.geotrack.email
Receives the Gmail address via POST on every browser startup and via addActiveUserFetchAsync when the content script first activates.
- geotrack.email
Receives the Gmail address via GET on first install (timeLine endpoint) and as a URL query parameter on uninstall.
What it can do
Permissions this extension asks for, as declared in version 3.0.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/*
Read and change your data on geotrack.email
https://geotrack.email/*
Read and change your data on beta.geotrack.email
https://beta.geotrack.email/*
Store data in your browser
storage