Am I Being Pwned?
Get started

Is Howdou for Google Classroom safe?

Medium risk

Howdou for Google Classroom sends the signed-in teacher's email address and assignment IDs to embed.howdou.net on every interaction.

The extension scrapes the user's Google Classroom email from the page DOM and appends it as a plaintext URL parameter to multiple requests sent to embed.howdou.net. It also collects assignment stream item IDs from the page and POSTs them to embed.howdou.net whenever the user navigates or scrolls. All requests are made with credentials included.

Howdouv6.5.0Chrome Web Store
45Risk
Who publishes it

Evalve AB - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Howdou
Declared legal entity
Evalve AB
Registered address
Västberga Allé 5, Hägersten 12630, SE
Registered contact
Johan Wikström
Website
howdou.net

Same store account

1 other listing published from this account, 6k+ users between them, none of them carrying a finding.

Howdou for students6k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Google Classroom Email Sent to Howdou

MediumunwantedCWE-359Dynamic sandbox

In Google Classroom, Howdou's content script reads your signed-in Google email from Classroom page links, then sends it as the e parameter to embed.howdou.net/gcapi/auth/statuscheck2.php, with credentials included.

What actually happens

You did this

You interact with Howdou while signed in to Google Classroom.

The content script only runs on Classroom pages, then reacts to Howdou controls and session checks.

The extension did this

The extension reads your Classroom account email from the page and adds it to a Howdou request.

The confirmed session-check request includes the email as the e query parameter.

Fields added to the Howdou session-check URL

  • Google Classroom account email
    alex.teacher@lincoln.k12.us (illustrative)

    This identifies the signed-in Google Classroom account associated with the request.

  • Howdou session ID
    9f0a8c6d2b1e4f30 (illustrative)

    This links the request to the active Howdou browser session.

Captured request

GEThttps://embed.howdou.net/gcapi/auth/statuscheck2.php
Headers
Content-Type
application/json

The code that does this

The shipped content script reads the email and sends it to the session endpoint

Readable version

Email extraction from Google account links

content.js
function getUserEmailAddress() {	var links = document.querySelectorAll(		"a[href^='https://accounts.google.com']"	);	for (var i = 0; i < links.length; ++i) {		if ( links[i].getAttribute("aria-label").match(/([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)/) ){			return links[0].getAttribute("aria-label").match(/([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)/)[0];		}	}	return '';}

Session check request that appends the email

content.js
function checkValidSession(){	var email = getUserEmailAddress();	//var ssoWin;	var xmlhttp = new XMLHttpRequest();	xmlhttp.onreadystatechange = function() {		if (this.readyState == 4 && this.status == 200) {			var response = JSON.parse(this.responseText);			if( response && response.valid_session != true ){				// Require login window				howdouSsoWin = window.open("https://embed.howdou.net/gcapi/auth/oauth.php?e="+email,"classroom_howdou_auth","width=600,height=600");			}else{				// Valid session active, load data				addImportFrame();			}		}	};	xmlhttp.open("GET", "https://embed.howdou.net/gcapi/auth/statuscheck2.php?e="+email+'&sid='+window.sessionStorage.getItem("howdousid"), true);	xmlhttp.withCredentials = true;	xmlhttp.setRequestHeader("Content-Type", "application/json");	xmlhttp.send();}

Howdou endpoints that receive the email value in code-built URLs

    • embed.howdou.net

    Receives the Classroom account email in the e URL parameter for session checks, OAuth launch URLs, assignment import frames, student-data frames, and schedule authorization URLs.

What it can do

Permissions this extension asks for, as declared in version 6.5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed Howdou for Google Classroom contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • embed.howdou.net

    Howdou for Google Classroom sends data to embed.howdou.net. No other extension we have analyzed sends data here.

Updated 2 November 2026ambboflfnkebhlggbbipeoniaooklpfp