What our analysis found

Save To Google Photos, used by 7,000 people, showed no malicious code in Extension Auditor's review. It comes from a trusted publisher and was last updated in December 2023.

Every network call in targets Google's official Photos API endpoints ( and:batchCreate) using an OAuth2 token scoped to photoslibrary.appendonly — upload-only, no read access. The five innerHTML hits are emoji characters (✅, ❌) and static status strings rendered inside the extension's own popup, not injected into web pages. Broad host_permissions are necessary to fetch image binaries from arbitrary URLs, which is the extension's core function. The ML score is driven entirely by legitimate signals: two POST requests to Google's API and chrome.identity.getAuthToken usage for Google OAuth. The bundled manifest exactly matches the published manifest — no permission mismatch. Third-party risk (Likelihood, featured extension, good rating) contradicts the ML signal; publisher's 44% malicious rate across other extensions is noted but this extension's code contains no malicious logic.