Chrome Web Store
23Versions
1Code reviewed

Caution required

Suspicious in code review (v4.2.1)

Our reviewer found behaviour consistent with malware in version 4.2.1, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.

563 indicators in this extension

563 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

Process Feedback - Writing Process Reports for Google Docs, used by 100,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by other. It comes from a trusted publisher and was last updated in September 2026.

Key findings

  • High

    Other

    The bundled manifest's web_accessible_resources entry declares 'public/*', while the published CWS manifest lists specific script files (,,). This discrepancy could indicate a mismatch between the reviewed version and the live listing.

  • High

    Credential Theft

    This script extracts the Google Docs auth token and user ID from the page and sets them as DOM attributes, potentially enabling credential theft if exfiltrated. The extension lacks OAuth permissions, indicating token usage is unauthorized.

Analyst notes

The extension includes a script () that extracts Google Docs auth tokens and user IDs, which is a credential theft risk. Additionally, the bundled manifest's web_accessible_resources differ from the published listing. No evidence of data exfiltration to third parties; data flow is between Google Docs and the publisher's own web app, as expected for the stated purpose. However, token extraction without proper OAuth consent is concerning.

Process Feedback - Writing Process Reports for Google Docs

Process Feedback - Writing Process Reports for Google Docs Chrome extension security report

ID: chcbikmmlhbbdkfiaaaljabpefdfajnb

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
4.2.3
Size
2.61 MB
Rating
5.0/5
Reviews
446
Users
100,000
Type
Extension
Updated
Sep 10, 2026
Category
Education
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
5extensions
All still listed

Publisher Contextual Analysis

Trusted
Author
Process Feedback
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Website
Visit
Extensions
5
Active
4
Obsolete
0
Listed
5
Unlisted
0
Users
101,455

Screenshots & videos

Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6
Screenshot 7
Screenshot 8
Screenshot 9
Screenshot 10
Screenshot 11

Install growth

Item
Type
Severity
Description
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 10% increase: Early script execution enables pre-emptive content manipulation
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
https://docs.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://classroom.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://docs.google.com/*, https://classroom.google.com/*
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.

563 indicators in this extension

563 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

Shows the edit history of a Google Docs document.

Read the publisher’s full description

📌 What is the Process Feedback extension? The Process Feedback extension is for teachers and students. It pulls the edit history of a Google Docs document and turns that history into a writing process report. In the process report, you can explore copy-paste events, the frequency and timing of breaks taken, typing fluency, time spent on each paragraph, time allocated to revision compared to initial drafting, and total typing time. ➛ Support for multiple tabs ➛ Shows user contributions ➛ Works for Google Classrooms 🛠 How do I use the extension? ➛ Step 1: Add this extension to your browser ➛ Step 2: Open your Google document ➛ Step 3: Find the “Explore Process” button near the menu bar and click on it ➛ Step 4: If you prefer the ribbon view instead, change the settings in the extension popup ❌ Unable to install the extension? ➛ To install any Chrome extension, you need to log in to Chrome. ➛ Please reload the Google Docs page after installing the extension. ➛ Your institution’s IT department may need to approve installing any new Chrome extension. 🔗 How to share the writing process report? ➛ Share Link: Copy the URL of the report link and share it. ➛ Share PDF: In the sidebar, click “Download Process Report” to download a PDF of the process report. 👤 Who is it for? The extension is primarily designed for students to self-reflect on their writing process. ⚙️ How does it work? The extension pulls the entire edit history of your Google Doc, which is already maintained by Google, and turns the writing journey into an interactive process report. 📚 How can teachers integrate it into a course? Please visit www.processfeedback.org/gdocs for step-by-step instructions on how to integrate the extension into your course. ✨ How is it different from other extensions? Unlike extensions like Draftback, this extension provides many rich features. Students can also download a PDF report or simply share a link to their process report. In a way, it is a free alternative to extensions like Draftback, Originality.ai, Revision History, and Grammarly Authorship, but with many more features. ⚠️ Limitations The extension is not well-tested with large documents with 100K+ changes or 100K+ characters. Its text styling is also not perfect yet. If you run into issues using the extension, please email us at contact@processfeedback.org. 📜 Terms and conditions By installing the extension, you agree to and acknowledge the terms and conditions at https://processfeedback.org/terms/. 🔒 Privacy policy ➛ By default, this extension does not collect any user data and runs fully locally in a user’s device. ➛ When a user chooses to save online, for sharing the report with others, it collects the author information and full edit history data of the Google Docs document. Collected data is stored only so users can view reports with the process report link and share the report with others. ➛ For co-edited documents, users should always obtain permission from all co-authors before viewing or sharing process reports. 📖 Reference/citation If you are using Process Feedback for a research project, please cite the following peer-reviewed research article: Adhikari, Badri; “Thinking Beyond Chatbots’ Threat to Education: Visualizations to Elucidate the Writing or Coding Process”; Education Sciences; 2023.

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs
71
IPv4
492

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

563 indicators in this extension

563 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
4.2.3
Latest
2.61 MBNot scanned—
43990a5002d66e8f943be6a9d9bbc2b15179138c05bd48123db8e9416ef16abd
4.2.2
2.61 MBNot scanned—
43990a5002d66e8f943be6a9d9bbc2b15179138c05bd48123db8e9416ef16abd
4.2.1
2.61 MBCaution0
43990a5002d66e8f943be6a9d9bbc2b15179138c05bd48123db8e9416ef16abd
4.2.0
2.61 MBNot scanned—
43990a5002d66e8f943be6a9d9bbc2b15179138c05bd48123db8e9416ef16abd
4.0.0
2.61 MBNot scanned—
43990a5002d66e8f943be6a9d9bbc2b15179138c05bd48123db8e9416ef16abd
3.9.5
0.19 MBNot scanned—
0430f1d2e97d815f0cf6892b2b5c85cef76cfb1ea6699ecd3ae70a8ed220932c
3.9.4
0.19 MBNot scanned—
0430f1d2e97d815f0cf6892b2b5c85cef76cfb1ea6699ecd3ae70a8ed220932c
3.9.3
0.19 MBNot scanned—
0430f1d2e97d815f0cf6892b2b5c85cef76cfb1ea6699ecd3ae70a8ed220932c
3.9.2
0.19 MBNot scanned—
0430f1d2e97d815f0cf6892b2b5c85cef76cfb1ea6699ecd3ae70a8ed220932c
2.2
0.06 MBNot scanned—
12ffb95c4cd43ce36a3fddc39ab28b4418d9d59ea54107620c996086f11310db
Showing 1 to 10 of 30 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.