I Unzipped 8 Gmail Tracking Extensions and Read Their Manifests

Every Gmail tracking extension asks Chrome for something. Almost nobody looks at what.

I build one of these extensions, so I had a selfish reason to look: I wanted to know whether my own permission list was actually leaner than the rest, or whether I just believed it was. So I downloaded the packages of eight Gmail tracking extensions straight from the Chrome Web Store, unzipped them, and read the manifest.json of each one.

Disclosure: I am the maker of BlueTicks for Gmail, one of the eight. Its row is in the table like the others, and one of the findings below is that it is not uniquely minimal.

What a manifest is, and why it is the honest place to look

A Chrome extension ships as a CRX file, which is a ZIP archive with a signature header. Inside it there is always a manifest.json, and that file declares, in plain text, every capability the extension can use:

• permissions, the Chrome APIs it can call: tabs, cookies, notifications, and so on.
• host_permissions, the sites whose content it may read and modify.
• content_scripts.matches, the pages into which it injects code.

Marketing copy is a claim. A manifest is a declaration Chrome enforces. You can read anyone's, right now, without installing anything:

curl -L -o ext.crx \
  "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=130&acceptformat=crx2,crx3&x=id%3D<EXTENSION_ID>%26uc"

Then find the ZIP signature and open the archive:

import io, json, zipfile
d = open('ext.crx', 'rb').read()
z = zipfile.ZipFile(io.BytesIO(d[d.find(b'PK\x03\x04'):]))
print(json.dumps(json.loads(z.read('manifest.json')), indent=2))

The extension ID is the 32-letter string in its Chrome Web Store URL.

What eight of them actually declare

Read on 30 July 2026, from the packages Chrome itself serves. Names are the store listing names. I have kept the raw permission strings rather than paraphrasing them.

Extension	Chrome API permissions	Host permissions
Email Tracker + Pixelblock	tabs, storage, unlimitedStorage, cookies, declarativeNetRequest, declarativeNetRequestWithHostAccess, declarativeNetRequestFeedback, gcm, notifications, scripting, offscreen, alarms, webNavigation	<all_urls>
Unlimited Email Tracker (Snov)	tabs, cookies, storage, notifications, scripting, alarms	snov.io, mail.google.com
Streak	storage, scripting, declarativeNetRequestWithHostAccess, management	mail.google.com, mailfoogae.appspot.com, googleusercontent.com, google.com, streak.com
Email Tracker by Mailtrack	storage, declarativeNetRequestWithHostAccess, notifications	mailtrack.io, mailsuite.com, mail.google.com, googleusercontent.com, api.rollbar.com, datadoghq.eu, two S3 buckets
Email Tracker by cloudHQ	scripting, storage, background, declarativeNetRequest, notifications, tabs	mail.google.com, cloudhq.net
MailTracker (Hunter)	declarativeNetRequest, storage, scripting (notifications optional)	mail.google.com, mailtracker.hunter.io
Mailtag	storage, scripting, declarativeNetRequest	mail.google.com, mailtag.io
BlueTicks for Gmail	storage, alarms, scripting, declarativeNetRequest	mail.google.com

All eight are Manifest V3. None of them declares an oauth2 block. Hold that thought, it matters below.

Three tiers, and the three strings worth pausing on

<all_urls>. One extension in the table can read and modify every page you visit. Its job is to tell you whether an email was opened. It is worth asking why that requires your banking tab. Combined with cookies and webNavigation, this is the broadest grant on the list by a wide margin.

cookies. Two extensions can read cookies. Cookies are session tokens. This is not the same order of ask as "let me draw a tick in your Sent list".

management. One extension can enumerate, enable and disable your other extensions. There are legitimate uses, mostly detecting conflicting Gmail add-ons. It is still a capability most users would not guess from the product description.

The rest sit in a scoped tier: Gmail plus the vendor's own domain, which is what you need to load a tracking pixel and talk to your own backend. Mailtrack's list is longer because it names its error reporting and log ingestion endpoints explicitly, which is arguably more honest than routing them through a wildcard.

And here is the finding I did not particularly want: BlueTicks for Gmail is in the leanest tier, but it is not alone there. Mailtag and Hunter's MailTracker declare almost the same thing. The single-host row is a real difference in degree, not a difference in kind. If you had told me before I ran this that my manifest would be unique, I would have believed you, and I would have been wrong.

The permission the manifest does not show you

None of these eight manifests contains an oauth2 block. That is easy to misread as "none of them asks for your Google account". It means something narrower: none of them asks for it through the extension.

The Google authorization screen, the one listing "Read, compose, send, and permanently delete all your email from Gmail", is requested by the vendor's web application, in a normal browser flow, usually right after install. It never appears in the extension package, so a manifest audit cannot catch it. A tool can have a modest manifest and still hold a token to your whole mailbox.

So the manifest is necessary and not sufficient. The complete check is two steps:

1. Read the manifest, as above, or open chrome://extensions, click Details, and read the permission list Chrome shows you.
2. Then go to myaccount.google.com/permissions and look at what each of these products holds against your Google account. That page is where "read, compose, send and permanently delete" actually lives, and it is where you revoke it.

Step 2 is the one almost nobody does, and it is the one that matters most.

What I would keep from this

Permission lists are one of the few claims in this category that you can verify yourself in about two minutes, without trusting anyone's marketing, including mine. The table above is a snapshot dated 30 July 2026; extensions update, and a manifest that is lean today can widen in the next release. The method outlives the table.

If you want the shortest possible version: an extension that only draws ticks in Gmail has no structural reason to ask for <all_urls>, for your cookies, or for a token to your mailbox. When it does, that is not necessarily malice, but it is always worth a question.

BlueTicks for Gmail is my Chrome and Firefox extension that puts WhatsApp-style ticks in your Gmail Sent list. It is 4 dollars a year, and there is a free tier. Site: blueticks.io. Chrome Web Store: BlueTicks for Gmail. Firefox: addons.mozilla.org.