Is Howdou for Google Classroom safe?

Medium risk

Howdou for Google Classroom sends the signed-in teacher's email address and assignment IDs to embed.howdou.net on every interaction.

The extension scrapes the user's Google Classroom email from the page DOM and appends it as a plaintext URL parameter to multiple requests sent to embed.howdou.net. It also collects assignment stream item IDs from the page and POSTs them to embed.howdou.net whenever the user navigates or scrolls. All requests are made with credentials included.

Howdouv6.5.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Google Classroom Email Sent to Howdou

In Google Classroom, Howdou's content script reads your signed-in Google email from Classroom page links, then sends it as the `e` parameter to embed.howdou.net/gcapi/auth/statuscheck2.php, with credentials included.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You interact with Howdou while signed in to Google Classroom.

The content script only runs on Classroom pages, then reacts to Howdou controls and session checks.

The extension did this

The extension reads your Classroom account email from the page and adds it to a Howdou request.

The confirmed session-check request includes the email as the `e` query parameter.

02EvidenceFIELD TABLE
Fields added to the Howdou session-check URL
FieldValueWhy it matters
Google Classroom account email
alex.teacher@lincoln.k12.us (illustrative)This identifies the signed-in Google Classroom account associated with the request.
Howdou session ID
9f0a8c6d2b1e4f30 (illustrative)This links the request to the active Howdou browser session.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://embed.howdou.net/gcapi/auth/statuscheck2.php
Headers
Content-Typeapplication/json
04EvidenceCODE COMPARE
The code that does this

The shipped content script reads the email and sends it to the session endpoint

What it actually does
Email extraction from Google account linkscontent.js
function getUserEmailAddress() {

	var links = document.querySelectorAll(
		"a[href^='https://accounts.google.com']"
	);
	for (var i = 0; i < links.length; ++i) {
		if ( links[i].getAttribute("aria-label").match(/([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)/) ){
			return links[0].getAttribute("aria-label").match(/([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)/)[0];
		}
	}
	return '';
}
Session check request that appends the emailcontent.js
function checkValidSession(){
	var email = getUserEmailAddress();

	//var ssoWin;

	var xmlhttp = new XMLHttpRequest();
	xmlhttp.onreadystatechange = function() {
		if (this.readyState == 4 && this.status == 200) {
			var response = JSON.parse(this.responseText);
			if( response && response.valid_session != true ){
				// Require login window
				howdouSsoWin = window.open("https://embed.howdou.net/gcapi/auth/oauth.php?e="+email,"classroom_howdou_auth","width=600,height=600");
			}else{
				// Valid session active, load data
				addImportFrame();

			}
		}
	};
	xmlhttp.open("GET", "https://embed.howdou.net/gcapi/auth/statuscheck2.php?e="+email+'&sid='+window.sessionStorage.getItem("howdousid"), true);
	xmlhttp.withCredentials = true;
	xmlhttp.setRequestHeader("Content-Type", "application/json");
	xmlhttp.send();

}
05EvidenceTHIRD PARTY LIST
Howdou endpoints that receive the email value in code-built URLs
  • embed.howdou.net

    Receives the Classroom account email in the `e` URL parameter for session checks, OAuth launch URLs, assignment import frames, student-data frames, and schedule authorization URLs.

Data recipients

embed.howdou.net
Updated 17 September 2026ambboflfnkebhlggbbipeoniaooklpfp