What our analysis found

GIPHY for Gmail, used by 80,000 people, is rated caution by Extension Auditor. Our code review reported 5 findings (2 high, 2 medium, 1 low), led by other. It comes from a trusted publisher and was last updated in August 2024.

Key findings

• high· other —The bundled manifest uses version 2, but the live Chrome Web Store listing shows manifest version 3. Additionally, the hosted permissions in the bundled manifest include and, which are absent from the published host_permissions. This mismatch suggests the extension may not be updated correctly or the deployed version differs from the submitted source.
• high· remote code loading —The InboxSDK loader fetches a remote script from ' ' via XHR and executes it using eval(). This bypasses the extension's CSP (which does not allow 'unsafe-eval') and allows arbitrary code execution from a third-party domain, representing a significant remote code loading vulnerability.
• medium· unauthorized data collection —The extension initializes Google Analytics tracking (UA-38174542-26) and sends pageviews and GIF click events. This collects usage data and sends it to a third party (). The CWS listing declared no data collection, making this unauthorized data collection.
• medium· unauthorized data collection —The InboxSDK error logging function sends detailed reports including user email hash, session ID, and extension ID to ' '. This constitutes unauthorized data collection, as the CWS listing did not disclose any data collection, and user email information is considered personally identifiable.
• low· other —The content script match pattern includes ' ', which is not a typical user-facing page and has no relation to the extension's functionality. Injecting scripts into this domain is unnecessary and could be a misconfiguration or an attempt to intercept analytics requests.

The extension uses remote code execution via eval of a remote script from, violating its own CSP and posing a security risk. It also collects user data via Google Analytics and InboxSDK error reporting without declaring any data collection in the CWS listing. The bundled manifest version (v2) does not match the published listing (v3), and content script injection into is unnecessary. These issues, while not malicious, indicate lax security practices and non-transparent data collection.