Is Meet Plus for Google Meet safe?

High risk

Meet Plus is high risk. Dynamic analysis captured a WebSocket to wss://meet-plus.com/googlemeetplus every Meet session. The first message, a 'join' event, included your Google email, extracted by scanning Meet's data with a regex, sent with no consent each join.…

Winfotech Incv11.5.7Chrome Web Store
77Risk
Who publishes it

Winfotech Inc - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Winfotech Inc
Declared legal entity
Winfotech Inc
Registered address
70 Temperance St, Toronto, ON M5H 0B1, CA

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

assets10.lottiefiles.com
Also called by 2 other listings, including Aksharakuppy - അക്ഷരക്കുപ്പി
meet-plus.com
Also called by 2 other listings, including Beyond Meet for Google Meet
assets9.lottiefiles.com
Also called by 3 other listings, including Open Earth Engine extension

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Meet Plus sends your Google email to meet-plus.com on every meeting join

Dynamic analysis captured a WebSocket to wss://meet-plus.com/googlemeetplus every Meet session.

The first message, a 'join' event, included your Google email, extracted by scanning Meet's data with a regex, sent with no consent each join.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You join a Google Meet meeting room.

The extension did this

The extension extracts your Google account email from the page and sends it to meet-plus.com over a WebSocket connection.

No user action beyond joining the meeting is required. The transmission happens on every meeting session.

Captured request
GETwss://meet-plus.com/googlemeetplus/socket.io/?EIO=4&transport=websocket

DA observation: two WS_CONNECT events to wss://meet-plus.com/googlemeetplus/ captured. Second send: 420["checkEList","robertfinwitch@gmail.com"], email transmitted a second time on the same session.

Body
42["join",{"meetingId":"abc-defg-hij","userName":"Robert Finwitch","version":"11.5.7","lang":"en-GB","email":"robertfinwitch@gmail.com","gid":"ACg8ocKrpjYARx9JBRfDKXHnclboELje4T_RLgpO-JTbqHBHtxAi_g","avatar":null}]
What Meet Plus sends in the join event on every meeting
  • Your Google email address
    robertfinwitch@gmail.com

    Your full Google account email, transmitted on every meeting join and again in a separate checkEList call.

  • Your Google user ID (GID)
    ACg8ocKrpjYARx9JBRfDKXHnclboELje4T_RLgpO-JTbqHBHtxAi_g

    A persistent identifier extracted from your Google avatar URL. Ties this transmission to your Google account across sessions.

  • Meeting room code
    abc-defg-hij

    The identifier for the specific meeting room you joined.

  • Your display name
    Robert Finwitch

    The name Google Meet shows other participants.

  • Extension version
    11.5.7

    Which version of Meet Plus you have installed.

  • Browser language
    en-GB

    Your browser's full locale setting.

The code that does this

Extension source code: how the email is extracted and transmitted

Readable version

Server connection config and socket setup

// The WebSocket server URL is hardcoded — no server-side toggle can disable this.const serverUrl = "https://meet-plus.com";const socketConfig = { url: serverUrl, path: "/googlemeetplus" };// socket.io connects using WebSocket transport only (no polling fallback)const socket = io(socketConfig.url, {  path: socketConfig.path,  upgrade: false,  transports: ["websocket"]});

Email extraction from Google Meet internal data

// Runs when the meetingInSession event fires (i.e., you join a meeting).// Walks Google Meet's internal AF_initDataChunkQueue data structure to find// any string matching an email pattern.const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;if (AF_initDataChunkQueue && AF_initDataChunkQueue.length > 0) {  AF_initDataChunkQueue.forEach(chunk => {    const data = Array.isArray(chunk.data) ? chunk.data : chunk.data();    const innerObj = data[Object.getOwnPropertySymbols(data)[0]];    const key = innerObj && Object.keys(innerObj)[0];    const values = innerObj && innerObj[key];    if (values && Array.isArray(values)) {      values.forEach((entry, idx) => {        // Capture email match        if (entry && typeof entry === 'string' && !capturedEmail) {          const match = entry.match(emailRegex);          if (entry.indexOf('@') !== -1) rawEmail = entry; // fallback          capturedEmail = match && match[0];               // regex-validated email        }        // Capture Google user ID from avatar URL        if (entry && typeof entry === 'string' &&            entry.indexOf('https') !== -1 &&            entry.indexOf('googleusercontent') !== -1) {          gid = extractGIDFromURL(entry);   // splits URL path, returns longest segment          avatarRef = values[idx + 1];        }      });    }  });}

join event emission with all fields

// Called as soon as the socket connects (via the 'connect' event handler).// Emits the join event with all harvested user data.function emitJoin(socket, meetingId, userName, suppressChecklist) {  if (meetingId && userName) {    socket.emit('join', {      meetingId: meetingId,          // Google Meet room code (e.g. abc-defg-hij)      userName: userName,             // user display name      version: extensionVersion,      // from manifest, e.g. "11.5.7"      lang: browserLocale,            // full locale, e.g. "en-GB"      email: window.onUser(),         // capturedEmail.toLowerCase() or "unknown_" + rawEmail      gid: window.userGID,            // Google user ID from avatar URL      avatar: getStoredAvatar()       // local storage ref    });  }}
Where your email is sent
    • meet-plus.com

    Primary server for Meet Plus extension features. Receives your Google email, GID, meeting ID, display name, version, and language on every meeting join via WebSocket.

Meet Plus extracts your Google user ID and sends it to meet-plus.com

Dynamic analysis captured the WebSocket join event Meet Plus sends every session.

The gid field is a Google user ID from your avatar URL.

The extension strips the URL to isolate this ID, stores it as window.userGID, and sends it on join.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You join a Google Meet meeting room.

The extension did this

The extension extracts a persistent Google user ID from your profile picture URL and sends it to meet-plus.com.

The GID is included in the same join payload as your email address and meeting details, transmitted without a consent prompt.

Captured request
GETwss://meet-plus.com/googlemeetplus/socket.io/?EIO=4&transport=websocket

Captured during DA test session (2026-04-15). The gid value ACg8ocKrpjYARx9JBRfDKXHnclboELje4T_RLgpO-JTbqHBHtxAi_g is the extracted Google user ID, a stable identifier tied to the Google account.

Body
42["join",{"meetingId":"abc-defg-hij","userName":"Robert Finwitch","version":"11.5.7","lang":"en-GB","email":"robertfinwitch@gmail.com","gid":"ACg8ocKrpjYARx9JBRfDKXHnclboELje4T_RLgpO-JTbqHBHtxAi_g","avatar":null}]
The code that does this

How the GID is extracted from the avatar URL

Readable version

GID extraction function h()

// Given a googleusercontent.com avatar URL, extracts the user's Google ID.// Example input:  https://lh3.googleusercontent.com/a/ACg8ocKrpjYARx9JB...=s96-c// Example output: ACg8ocKrpjYARx9JB...function extractGIDFromURL(url) {  if (!url) return null;  try {    const parts = decodeURI(url).split('/');    parts.splice(0, 4);           // drop protocol + host + first path segments    // The longest remaining segment is the user ID    return parts.sort((a, b) => b.length - a.length)[0].split('=')[0];  } catch (e) {    return null;  }}

Avatar URL scan and GID storage

// Inside the AF_initDataChunkQueue scan: looks for googleusercontent URLsif (entry && typeof entry === 'string' &&    entry.includes('https') &&    entry.includes('googleusercontent')) {  gid = extractGIDFromURL(entry);   // parse GID out of avatar URL path  avatarRef = values[idx + 1];      // store adjacent data as avatar reference}// After the scan:if (gid) window.userGID = gid;      // store globally for use in join payload
Where your Google user ID is sent
    • meet-plus.com

    Primary extension server. Receives your Google user ID in the socket.io join payload on every meeting session, alongside your email, meeting ID, and display name.

Meet Plus sends meeting ID and display name to meet-plus.com on each join

Dynamic analysis captured the socket.io 'join' event Meet Plus sends every Meet session.

The payload has your room code, display name, version, and locale, plus your email and user ID, sent automatically with no consent prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You join a Google Meet meeting room.

The extension did this

Meet Plus transmits the meeting room code, your display name, the extension version, and your browser language to meet-plus.com.

These four fields arrive in the same socket.io join payload as your Google email and user ID, sent on every meeting session.

Captured request
GETwss://meet-plus.com/googlemeetplus/socket.io/?EIO=4&transport=websocket

Captured during DA test session (2026-04-15). All four claimed data types, meetingId, userName, version, lang, present alongside email and gid in the same captured frame.

Body
42["join",{"meetingId":"abc-defg-hij","userName":"Robert Finwitch","version":"11.5.7","lang":"en-GB","email":"robertfinwitch@gmail.com","gid":"ACg8ocKrpjYARx9JBRfDKXHnclboELje4T_RLgpO-JTbqHBHtxAi_g","avatar":null}]
Meeting-session fields sent in the join payload
  • Meeting room code
    abc-defg-hij

    The identifier for the meeting room you joined, tells the server which call you're in.

  • Your display name
    Robert Finwitch

    The name shown to other participants in Google Meet.

  • Extension version
    11.5.7

    Which version of Meet Plus is installed. Used by the server to distinguish client versions.

  • Browser language
    en-GB

    Your browser's full locale setting, which can indicate your country or region.

The code that does this

The join event emission with all fields

Readable version

Complete join event emission

// Called once the socket.io connection is established.// Emits all user and session data to meet-plus.com.function emitJoin(socket, meetingId, userName, suppressChecklist) {  if (meetingId && userName) {    socket.emit('join', {      meetingId: meetingId,         // Google Meet room code, e.g. "abc-defg-hij"      userName:  userName,           // user's display name in the meeting      version:   extensionVersion,   // manifest version, e.g. "11.5.7"      lang:      browserFullLocale,  // full locale string, e.g. "en-GB"      email:     window.onUser(),    // Google email (from AF_initDataChunkQueue scan)      gid:       window.userGID,     // Google user ID (from avatar URL)      avatar:    getStoredAvatar()   // avatar reference from local storage    });  }}

Meeting ID regex and socket connect sequence

// Meeting room codes follow the pattern: xxx-xxxx-xxx (all letters).const meetingIdPattern = /^[a-zA-Z]{3}-[a-zA-Z]{4}-[a-zA-Z]{3}$/;// to() sets up the 'connect' handler, which fires emitJoin() once// the WebSocket handshake with meet-plus.com completes.function connectAndJoin(socket, meetingId, userName, suppressChecklist) {  if (socket) {    socket.on('connect', () => {      emitJoin(socket, meetingId, userName, suppressChecklist);    });  }}
Where the meeting metadata is sent
    • meet-plus.com

    Extension feature server. Receives meeting ID, display name, version, and locale on every meeting join, combined with Google email and GID in the same payload.

What it can do

Permissions this extension asks for, as declared in version 11.5.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on meet.google.com

    *://meet.google.com/*

  • See the address and title of every tab you have open

    tabs

  • Sign you in with your Google account

    identity

Updated 30 September 2026lbfjgknkjfjmnjdgdhbbmmbkoddgpdoc