Chrome Web Store

37Versions

1Code reviewed

No malware found

In code review

Our reviewer read this extension’s code and found no malicious behaviour. An automated risk flag was reviewed and overturned.

What our analysis found

OrbitNote, used by 4,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in February 2026.

OrbitNote is a legitimate educational tool by a trusted publisher (Texthelp) with 5M+ users, featured on CWS, and a Google trusted badge. All outbound communications go to first-party domains (,,) or disclosed services (Google Analytics, Google Drive APIs,), matching the published privacy policy and CWS disclosure of personally identifiable information and user activity. The broad permissions (webRequest, scripting, identity) are necessary for the extension’s core functionality: intercepting PDFs, injecting a viewer button, and integrating with LMS platforms. The ML model’s regex pattern hits (e.g., XMLHttpRequest, innerHTML, base64) are standard in code and data‑URI icons, not malicious obfuscation. User complaints about forced installation and bugs do not indicate malware. No evidence of unauthorized data exfiltration, tracking to third parties, or code injection beyond the extension’s declared scope.

OrbitNote

ID: feepmdlmhplaojabeoecaobfmibooaid

Supported Languages

🇬🇧British English

Extension Info & Metadata

Status

Active

Version

7.0.4

Size

0.96 MB

Rating

3.0/5

Reviews

137

Users

4,000,000

Type

Extension

Updated

Feb 3, 2026

Publisher Contextual Analysis

Trusted

Author: EVERWAY OPCO LIMITEDView Profile
Privacy: Privacy Policy
Help: Help Center
Country: GB
Address: 1 Orchard Way ANTRIM BT41 2RU GB
Website: Visit

Extensions

Active

Obsolete

Listed

Unlisted

Users

13,000,000

Screenshots & videos

Install growth

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+200%(+4,000,000 users)

Compared to 3 months ago

7 versions released in this period

Rating Count

Total: 123 ratings+1 (1%)

Average Rating

Current: 3.63 / 5.0-0.21

See plans

React Flow

Internal permhash`73eec22792…`
No malicious matches

No other extension carries this fingerprint.

Permhash (Mandiant)`33f7990558…`
No malicious matches

No other extension carries this fingerprint.

Network indicators

364 URLs and 2 IP literals were extracted from this version.

Item	Type	Severity	Description
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
scripting	Permission	Critical	This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
https:///	Host	Critical	Broad host access — the extension can read/modify content on every website.
http:///	Host	Critical	Broad host access — the extension can read/modify content on every website.
webNavigation	Permission	High	This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
identity	Permission	High	This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
identity.email	Permission	High	This permission directly accesses the user's email address. Rated High because it reveals personally identifiable information and can be used for tracking or targeting.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 10% increase: Early script execution enables pre-emptive content manipulation
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
gcm	Permission	Medium	This permission enables Google Cloud Messaging for push notifications. Rated Medium because it can maintain persistent connections, receive external messages, and operate in the background.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
https://www.google-analytics.com/	Host	Medium	Host permission — access limited to this URL pattern.
Access to Sensitive Domains	Risk Factor	Medium	This extension requests access to sensitive domains: https://www.google-analytics.com/
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
idle	Permission	Low	This permission detects system idle state. Rated Low because it only observes user activity state without access to activity details.
alarms	Permission	Low	This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Sensitive Domain Access

This extension has access to the following sensitive domains:

https://www.google-analytics.com/

Each row lists a threat category the scanner evaluates. A checkmark means the review ran and found no matching issues in that category for this version.

Data Exfiltration
Code review completed; no malicious patterns detected for this category.
Unauthorized Data Collection
Code review completed; no malicious patterns detected for this category.
Network Interception
Code review completed; no malicious patterns detected for this category.
Code Injection
Code review completed; no malicious patterns detected for this category.
Credential Theft
Code review completed; no malicious patterns detected for this category.
Obfuscation
Code review completed; no malicious patterns detected for this category.
Tracking
Code review completed; no malicious patterns detected for this category.
Privilege Escalation
Code review completed; no malicious patterns detected for this category.
Phishing
Code review completed; no malicious patterns detected for this category.
Remote Code Loading
Code review completed; no malicious patterns detected for this category.
Other
Code review completed; no malicious patterns detected for this category.

Gain full insight into all external connections.

Upgrade for full visibility.

About this extension

Create, convert, connect: take your digital documents to the next level with OrbitNote.

Read the publisher’s full description

Create, convert, connect: take your digital documents to the next level with OrbitNote. Searching for a way to make digital documents accessible, dynamic and more collaborative? Download OrbitNote to transform and interact with digital documents in a completely different way! With OrbitNote you can make digital documents accessible and actionable, while demonstrating and giving feedback in multiple formats. It’s a great tool to boost productivity, connections and collaboration! Open digital documents in Google Drive, OneDrive, on the web app, in your LMS (Google Classroom and Schoology), or on your local device, then use OrbitNote to: • Collaborate in real-time within digital documents • Read text, including math & science equations, aloud with easy-to-follow dual color highlighting • Type text on top of your PDFs with the Text feature • Highlight and extract information with colored highlighters • Add text and voice comments or use pushpins for helpful hints or instructions • Use freehand or shape drawing to scribble and draw on your digital documents • And more! Try OrbitNote today to check out all of the above features for a limited time. We have much more planned for this tool later in the year. As OrbitNote grows and new features are added, a premium version requiring a subscription will be introduced. Premium Read&Write users can enjoy access to a version of OrbitNote as part of their Read&Write subscription. Get more information on OrbitNote’s features and future plans at https://www.texthelp.com/products/orbitnote/ For any technical questions, contact us at: support@texthelp.com

User reviews

1.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

its cheeks don't get it fn

Keelan Henry·25 Aug 2026

I'm just asking when will school boards understand that THIS IS THE WORST EXTENSION EVER? I just can't stand the "error.auth" and it auto opening google classroom pdf's. Please... please either orbitnote deletes orbitnote or someone [5 words [REDACTED]] delete it pls like WHY? I HAD TO SPEND 3 DAYS FINDING A WORK-A-ROUND! ANOTHER WAY TO OPEN PDFS IN A TAB INSTEAD OF IN ORBITNOTE THAT TAKES 1 MIN TO LOAD AND ANOTHER 1 MIN TO LOG IN THEN ANOTHER 1 MIN TO LOAD THE DOC THEN IF IT HASN'T QUIT THE TAB AND BECOME UNRESPONSIVE BY THEN, THEN IT'S A 1 IN 987 DUOTRIGINTILLION CHANCE!!!!! BUT OH IT JUST QUIT HALF A MINUTE LATER I CAN'T EVEN USE IT AND I'M FORCED TO!!! TO ALL PEOPLE THAT HATE ORBITNOTE: Right click the file in google classroom and click "open in a new tab" that let's you open in google docs INSTEAD OF F*&#%@ ORBITNOTE To orbitnote founders: please consider deleting orbitnote no one wants it.

Charlie·15 Jul 2026

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs

364

IPv4

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found

No IP addresses found

Gain full insight into all external connections.

Upgrade for full visibility.

Version	Size	Verdict	Findings	Permhash
7.0.4 Latest	0.96 MB	No malware found	0	33f79905587ad21d923ae8f7b37f4e66699a50c37a36a3cf670899e83fe6174b
7.0.3	0.95 MB	Not scanned	—	33f79905587ad21d923ae8f7b37f4e66699a50c37a36a3cf670899e83fe6174b
7.0.0	0.91 MB	Not scanned	—	33f79905587ad21d923ae8f7b37f4e66699a50c37a36a3cf670899e83fe6174b
6.0.18	2.56 MB	Not scanned	—	7ca00c9e40a97f1540b0a466c7aeeca586ccc663fe76b1113a3ed496b576163a
6.0.17	2.59 MB	Not scanned	—	7ca00c9e40a97f1540b0a466c7aeeca586ccc663fe76b1113a3ed496b576163a
6.0.16	2.59 MB	Not scanned	—	7ca00c9e40a97f1540b0a466c7aeeca586ccc663fe76b1113a3ed496b576163a
6.0.13	3.15 MB	Not scanned	—	7ca00c9e40a97f1540b0a466c7aeeca586ccc663fe76b1113a3ed496b576163a
6.0.12	3.14 MB	Not scanned	—	7ca00c9e40a97f1540b0a466c7aeeca586ccc663fe76b1113a3ed496b576163a
6.0.11	2.58 MB	Not scanned	—	7ca00c9e40a97f1540b0a466c7aeeca586ccc663fe76b1113a3ed496b576163a
6.0.10	2.58 MB	Not scanned	—	7ca00c9e40a97f1540b0a466c7aeeca586ccc663fe76b1113a3ed496b576163a

Showing 1 to 10 of 40 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Popular in Accessibility

360 Internet Protection19,000,000 users
Volume Master7,000,000 users
Dark Reader7,000,000 users
Read Aloud: A Text to Speech Voice Reader6,000,000 users
中国建设银行Ukey扩展5,286,499 users

No malware found

What our analysis found