Is SAP Sales Cloud for Gmail safe?

Low risk

SAP Sales Cloud for Gmail exposes stored identity tokens to scripts on its matched Gmail, Calendar, and SAP pages.

Its content script accepts same-page window.postMessage commands on Gmail, Calendar, and SAP cloud pages and forwards token get, set, and remove requests to the background worker. The background worker stores tokens in chrome.storage.sync under an email-based __crm_marker key and returns them to the page without tying the request to a configured tenant or SAP iframe origin.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

SAP SEv2608.0.0.135Chrome Web Store
15Risk
Who publishes it

SAP - 7 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
SAP SE
Declared legal entity
SAP
Registered address
Dietmar-Hopp-Allee 16, Walldorf 69190, DE

Same store account

5 other listings published from this account, 263k+ users between them, none of them carrying a finding.

SAP Enable Now200k+CleanSAP Companion, browser extension30k+LowCxAppChrome20k+CleanSAP Enable Now, browser application recorder9k+HighSAP Enable Now, custom desktop application recorder4k+Low

Same operator - 2 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

UI5 Inspector
same registered address
50k+Low1 more listing in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed SAP Sales Cloud for Gmail contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mail.google.com

    SAP Sales Cloud for Gmail sends data to mail.google.com. 19 other extensions we have analyzed send data here.

  • calendar.google.com

    SAP Sales Cloud for Gmail sends data to calendar.google.com. 4 other extensions we have analyzed send data here.

  • *.ondemand.com

    SAP Sales Cloud for Gmail sends data to *.ondemand.com. No other extension we have analyzed sends data here.

  • *.sapbydesign.com

    SAP Sales Cloud for Gmail sends data to *.sapbydesign.com. No other extension we have analyzed sends data here.

  • *.saphybriscloud.com

    SAP Sales Cloud for Gmail sends data to *.saphybriscloud.com. No other extension we have analyzed sends data here.

Updated 2 November 2026dpolpgcoaadhofccfkjdknifhofinflb