Is Odoo Utility safe?

Medium risk

Odoo Utility inserts saved custom login credentials into Odoo-looking login pages on most websites.

Odoo Utility runs a content script on all websites and skips only a short list of official Odoo domains. When a page contains Odoo login form markup, it reads the extension's synced options and adds login buttons that place saved custom username and password values into page DOM attributes before submitting the form.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Droggolv4.2Chrome Web Store
40Risk
Who publishes it

Droggol - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Droggol

Same store account

1 other listing published from this account, 200k+ users between them, none of them carrying a finding.

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

droggol.com
Also called by 1 other listing: Odoo Utility
runbot.odoo.com
Also called by 4 other listings, including Odoo Utility, Odoo Tab Manager, Odoo Ecosystem
odoo.sh
Also called by 6 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 4.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 4.2, which we have not unpacked yet.

  • Store data in your browser

    storage

Updated 2 November 2026jllbemjkkabaohnjcnajhflahlkehmlf