What our analysis found

Google Calendar Background, used by 2,000 people, is rated caution by Extension Auditor. Our code review reported 4 findings (1 critical, 3 high), led by remote code loading. It comes from a trusted publisher and was last updated in October 2026.

Key findings

• Critical

  Remote Code Loading

  The entire Checkout page content is fetched from [domain withheld] (a third-party monetization platform) and injected as raw HTML via `document.documentElement.innerHTML = text`. This gives the remote server full control over the structure and content of the extension's privileged Checkout page at runtime — it can inject arbitrary form fields, hidden iframes, data attributes that alter the payment flow, and phishing UI. This is a textbook remote loading pattern.

  Show more — Remote Code Loading
• High

  Unauthorized Data Collection

  The user's Google account email (`mail`) and account ID (`appid`) — obtained through Google OAuth — are transmitted as cleartext URL parameters to [domain withheld], a third-party server unrelated to the extension's declared calendar-background purpose. The CWS listing declares zero data collection categories. This constitutes undisclosed exfiltration of Google account PII to a third-party billing platform.

  Show more — Unauthorized Data Collection
• High

  Credential Theft

  The extension initiates a Google OAuth flow requesting the user's email and profile (`userinfo.email`, `userinfo.profile`) with `response_type=code` (authorization code grant), but the redirect_uri is `[domain withheld] — a Cloudflare Workers endpoint operated by the [domain withheld] SDK, not by the extension publisher. This third-party relay receives the OAuth authorization code, exchanges it for Google tokens server-side, and returns the user's email back via URL parameters. The user's Google account credentials flow through an operator completely opaque to the publisher.

  Show more — Credential Theft
• High

  Other

  The subscription and login UI is gated behind a hardcoded Unix timestamp (1760959946, approximately late October 2025) with an inline comment in Chinese that translates to 'after 3 days, which proves review has passed, only then show login.' This is explicit, documented review evasion: the behavior is intentionally hidden during Google's review window and activated only once the extension is approved. Coupled with locale-gating that suppresses the flow entirely for Chinese-locale users (presumably the developer's own locale during testing), this demonstrates deliberate deception of the Chrome Web Store review process.

  Show more — Other