Chrome Web Store
18Versions
1Code reviewed

No malware found

In code review (v6.4)

Our reviewer read version 6.4 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

My Apps Secure Sign-in Extension, used by 2,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

The extension is a legitimate Microsoft SSO extension for Azure All data flows (telemetry, app proxy, SSO scripts) are to Microsoft-controlled endpoints (*., *., etc.), which are first-party and necessary for core functionality. The permissions—though broad—are required for SSO, app proxy link translation, and password management. The code contains no obfuscation beyond standard compression libraries and server-sent script decoding. The manifest version in the bundled source (MV2) differs from the CWS published summary (MV3), but this is likely a version skew and not indicative of malice. No unauthorized data exfiltration, code injection, or credential theft was found.

My Apps Secure Sign-in Extension

My Apps Secure Sign-in Extension

ID: ggjhpefgjjfobnfoldnjipclpcfbgbhl

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status
Active
Version
8.2.1.252
Size
0.18 MB
Rating
2.2/5
Reviews
142
Users
2,000,000
Type
Extension
Updated
Sep 10, 2026
Category
Workflow & planning
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
10extensions
2 no longer listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
MicrosoftView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Extensions
10
Active
6
Obsolete
2
Listed
9
Unlisted
1
Users
39,230,680

Screenshots & videos

Screenshot 1

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
https://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
http://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: • 10% increase: Early script execution enables pre-emptive content manipulation
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.

Gain full insight into all external connections.

Upgrade for full visibility.

About this extension

My Apps Secure Sign-in Extension

Read the publisher’s full description

This extension is required for both App Proxy link translation and application password-based single sign-on. It may also be optionally used to launch the My Apps portal to search the applications you have access to. With this extension you can: • Sign into password-based single sign-on applications- both directly from the application's login page and from the My Apps portal • Access internal company URLs while remote • Launch into the My Apps portal to search across the applications you have access to Learn more: • App proxy link translation: https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-configure-hard-coded-link-translation • Password-based single sign-on: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-password-single-sign-on-non-gallery-applications • My Apps portal: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/myapps-overview THIRD-PARTY SOFTWARE NOTICES AND INFORMATION This software is based on or incorporates material from the projects listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and license, under which Microsoft received such Third Party Code, are set forth below. Microsoft reserves all rights not expressly granted herein, whether by implication, estoppel or otherwise. JavaScript Zlib Library Copyright (c) 2012 imaya The MIT License Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. JavaScript autoComplete v1.0.4 Copyright (c) 2014 Simon Steinberger / Pixabay The MIT License Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

No network indicators were extracted from this version.

Showing 1 to 10 of 20 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

More from Microsoft

Popular in Workflow & Planning