Chrome Web Store

408Versions

1Code reviewed

No malware found

In code review (v3.1.60602.1906)

Our reviewer read version 3.1.60602.1906 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Superhuman Mail, used by 100,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages. It comes from a trusted publisher and was last updated in October 2026.

All outbound communication goes to the publisher’s own domain (); content scripts are limited to known webmail providers and mailto: handling; permissions are justified for an email client; no evidence of unauthorized data collection or code injection. The ML model likely overfit on broad permissions and minified code patterns, but the extension is a legitimate productivity app with a trusted publisher and disclosed data collection.

Superhuman Mail Chrome extension security report

ID: dcgcnpooblobhncpnddnhoendgbnglpn

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Active

Version

3.1.61008.2132

Size

5.96 MB

Rating

4.2/5

Reviews

Users

100,000

Type

Extension

Updated

Oct 10, 2026

Publisher Contextual Analysis

Trusted

Author: https://mail.superhuman.com
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 548 Market St #39105 San Francisco, CA 94104-5401 US
Website: Visit

Extensions

Active

Obsolete

Listed

Unlisted

Users

100,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Install growth

User Growth

Showing data from Jan 14, 2022 to Jan 13, 2023

Versions

No change in user count

Compared to 3 months ago

6 versions released in this period

Rating Count

Total: 20 ratings

Average Rating

Current: 4.35 / 5.0

See plans

React Flow

Internal permhash`48426dba58…`
No malicious matches

1 other extension carries this fingerprint, none of them known malicious.

Withheldnot flagged

Permhash (Mandiant)`bd4817de28…`
No malicious matches

1 other extension carries this fingerprint, none of them known malicious.

Withheldnot flagged

Network indicators

623 URLs and 3 IP literals were extracted from this version.

Item	Type	Severity	Description
scripting	Permission	Critical	This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
http:///	Host	Critical	Broad host access — the extension can read/modify content on every website.
https:///	Host	Critical	Broad host access — the extension can read/modify content on every website.
offscreen	Permission	High	This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk: • 10% increase: Early script execution enables pre-emptive content manipulation • 25% increase: Unsafe code evaluation capabilities increase attack surface • 10% increase: About:blank access enables potential sandbox escape vectors
Unsafe WebAssembly Execution	Risk Factor	High	This extension's CSP allows "wasm-unsafe-eval".
background	Permission	Medium	This permission allows continuous background operation. Rated Medium because it can perform actions without user awareness, consume system resources, and maintain persistent connections.
gcm	Permission	Medium	This permission enables Google Cloud Messaging for push notifications. Rated Medium because it can maintain persistent connections, receive external messages, and operate in the background.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
system.cpu	Permission	Medium	This permission provides access to CPU usage and information. Rated Medium because it can monitor system performance, detect other applications, and potentially identify user activities.
system.memory	Permission	Medium	This permission accesses system memory information. Rated Medium because it can monitor memory usage patterns, detect other applications, and gather system state information.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
unlimitedStorage	Permission	Medium	This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
About:blank Access	Risk Factor	Medium	This extension can run content scripts in about:blank pages.
alarms	Permission	Low	This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
notifications	Permission	Low	This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
system.display	Permission	Low	This permission reads display configuration. Rated Low because it only accesses screen properties without content access.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

About this extension

The most productive email app ever made.

Read the publisher’s full description

Superhuman Mail is the most productive email app ever made. Collaborate faster and get more done with AI-native email. Cut through the noise and stay focused on the highest-impact work. Superhuman Mail helps you spot what matters, respond instantly, and keep every conversation flowing — without getting buried in threads or losing time to low-priority tasks. Follow up on time, every time, never drop a critical request, and move faster as a team, with shared context and seamless handoffs. Get 4 hours back, every single week, with Superhuman Mail.

User reviews

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Notifications are hard to manage properly

Gabriel Beaudoin·30 Jul 2026

I've used Superhuman for five years now and it's still the best email client I've tried. You have to grok the methodology though, or it's not worth it. Here's the deal for the reinstall complaliners - when it asks to reinstall the extension just ctrl-R to reload and bam it's taken care of. Oh yeah and I don't subscribe to the AI version because it's junk. Get the basic cheap version and it's all you need. The AI is just bloatware to justify upgrades that weren't needed.

Gavin Bowie·17 Nov 2025

Overpriced junk. The thought process is fine, make email easier. But the AI stuff DOES NOT WORK. Auto labels, to be able to use split inboxes, are not consistently accurate. The Ask AI feature has no clue what is going on, but it constantly misses emails, not labeling them, and thus, they dont get the attention they are supposed to get, attention I expect to be able to give, considering the claims of this $40/m software. I gave this thing 6 months. It's over. They are not improving, so time to find something else.

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

623

IPv4

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found

No IP addresses found

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Version	Size	Verdict	Findings	Permhash
3.1.61008.2132 Latest	5.96 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.61007.1910	5.96 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.61006.1900	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.61005.2056	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.61002.1906	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.61001.1906	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.60930.1906	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.60929.1906	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.60928.1906	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b
3.1.60925.1906	5.98 MB	Not scanned	—	bd4817de2833734c20513f50766414f9fd5d882774ca30c99a67c92ae69c8e3b

Showing 1 to 10 of 410 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Popular in productivity/communication

Grammarly: AI Writing Assistant and Grammar Checker App44,000,000 users
Loom – Screen Recorder & Screen Capture8,000,000 users
QuillBot: AI Writing and Grammar Checker Tool5,000,000 users
DeepL: translate and write with AI4,000,000 users
Email Tracker by Mailtrack®3,000,000 users

No malware found

What our analysis found