Is Vonage® Integration Suite safe?
Vonage Integration Suite bundles a hardcoded OAuth client_secret that allows any installer to perform token exchanges against the Vonage API.
The extension's JavaScript bundle contains a static OAuth client_secret used when refreshing or exchanging authorization codes against the Vonage API endpoint at extensions.gunify.vonage.com/v2/auth/token. Because the secret is embedded in plain text within the distributed .crx file, any party who downloads or installs the extension can extract it and submit OAuth requests as the registered client. No user interaction beyond installation is required to access the credential.
Who publishes itVonage Business Inc - 1 other listing from the same operator, none carrying a finding
Vonage Business Inc - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 1 listing
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2025.917.1612.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on extensions.gunify.vonage.com
https://extensions.gunify.vonage.com/*
Keep running in the background while your browser is open
background
Add items to the right-click menu
contextMenus
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Show you desktop notifications
notifications
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed Vonage contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- extensions.gunify.vonage.com
Vonage sends data to extensions.gunify.vonage.com. No other extension we have analyzed sends data here.