Is Video Editor by DriveEditor.com safe?
Video Editor by DriveEditor.com sends Google account emails in Google Analytics events from Drive pages and the editor.
When it detects Google Drive video pages or users export and download from the editor, the extension reads a stored Google account email and includes it in Google Analytics event payloads. Its service worker also sends entered license keys to LemonSqueezy for validation using a bundled bearer token.
Who publishes itUpper Group Ltd. - 5 other listings from the same operator, none carrying a finding
Upper Group Ltd. - 5 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 5 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Google account email sent in Google Analytics events from Drive pages
On Google Drive video pages or in the editor, the extension includes your stored Google account email in Google Analytics event payloads sent to www.google-analytics.com/mp/collect, alongside analytics identifiers and event parameters.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You interact with Google Drive video pages or use export and download actions in the editor.
The extension adds the stored Google account email to Google Analytics event payloads.
- Stored Google account emailuser@example.com (illustrative)
An email address identifies the signed-in Google account and can connect analytics events to that account.
What it can do
Permissions this extension asks for, as declared in version 1.4.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on drive.google.com
https://*.drive.google.com/*
Read and change your data on youtube.googleapis.com
https://youtube.googleapis.com/*
Read and change your data on api.lemonsqueezy.com
https://api.lemonsqueezy.com/*
Read and change your data on driveeditor-55780-default-rtdb.firebaseio.com
https://driveeditor-55780-default-rtdb.firebaseio.com/*
Read and change your data on drive-editor-23660-default-rtdb.asia-southeast1.firebasedatabase.app
https://drive-editor-23660-default-rtdb.asia-southeast1.firebasedatabase.app/*
Read and change your data on firebaseapp.com
https://*.firebaseapp.com/*
Read and change your data on googleapis.com
https://*.googleapis.com/*
Read and change your data on localhost:3244
http://localhost:3244/*
Store data in your browser
storage
Sign you in with your Google account
identity
Run its own code inside the pages you visit
scripting
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed Video Editor by DriveEditor.com contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Video Editor by DriveEditor.com sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- api.lemonsqueezy.com
Video Editor by DriveEditor.com sends data to api.lemonsqueezy.com. 4 other extensions we have analysed send data here.