The Mixmax Chrome Extension: Five Permission Scopes and Ten Named Conflicts

The Mixmax Chrome extension asks for five Google permission scopes, one of which is full read, send, delete and manage access to your mailbox. Mixmax's own help centre publishes the list, explains what each scope powers, and states plainly that the scope named read your email does not mean it reads your inbox. That page is worth ten minutes before a rollout, because the conversation with a security-minded Workspace admin goes very differently depending on whether you have read it.

The extension is also the load-bearing component of the product rather than a convenience wrapper. Without it installed, most of what Mixmax sells does not appear.

Everything below is verified against Mixmax's help centre at success.mixmax.com and its Chrome Web Store listing, fetched 15 August 2026.

What the extension actually adds

Mixmax describes the extension as the thing that adds Mixmax features to Gmail, and to Salesforce where that integration is enabled. Three surfaces are named in its own documentation.

Clicking the extension icon authenticates a logged-out session and opens a new Mixmax compose window. Inside Gmail, the extension is what surfaces the email enhancements and the side panel Mixmax calls Sidechat. Inside Salesforce, it is what puts the Add to Sequence and Call buttons on the record and what signs you back in when a Mixmax feature is clicked from a logged-out state.

That last surface is the one people underestimate. A team that intends to work from Salesforce rather than from Gmail still needs the browser extension deployed on every machine, because the buttons it wants live in the extension rather than in a Salesforce package.

The five permission scopes, and what each one buys

Mixmax publishes the scopes it requests along with a justification for each. This is the section to bring to a security review, and the qualifier on the first one is the part that matters.

The first row is the one that stops rollouts. Mixmax's own note is that this is the name of the Google permission rather than a description of Mixmax's behaviour, and it states that Mixmax cannot read email in your inbox. The scope is broad because Google's scope taxonomy is coarse: there is no narrower grant that allows an application to send on your behalf and observe delivery events.

Worth being precise about what that does and does not settle. The vendor's statement about its own behaviour is a statement, not a technical constraint, and the grant itself is broad regardless. Both facts are true at once, and a security review that wants more than a vendor assurance should be asking for the data processing agreement rather than re-reading the scope list.

Before deploying Mixmax across a team

• ✓Yes: Confirm the Workspace admin has allowlisted the extension, or installation fails with an administrator error
• ✓Yes: Take the five permission scopes and their published justifications into the security review
• ✓Yes: Audit the browser for Gmail-modifying extensions already installed, which is the documented conflict class
• ✓Yes: Run the incognito test on one machine to separate a genuine conflict from a Mixmax fault
• ~Depends: Check whether the team works from Salesforce, which still needs the extension on every machine
• ✕No: Assume a Salesforce-first team can skip the browser install

Installation, and the error that means it is not your problem

The documented path has two entrances. Either start at mixmax.com and click get started for free, or open the Chrome Web Store listing and click add to Chrome. Both routes then require agreeing to the terms and privacy policy, selecting the Google account to pair, and clicking allow on the permission prompt. Mixmax notes that you should use the same address you signed up with, which is the usual cause of a confusing half-configured state on machines where somebody is signed into two Google accounts.

One error message is worth memorising: this application is not allowed by your administrator. That is Google Workspace policy blocking the extension, not a Mixmax failure and not something a reinstall fixes. It needs a Workspace admin to permit the app. Anyone rolling Mixmax out to a team should clear that with the admin first rather than discovering it on twenty machines at once.

Extension conflicts are a named, documented failure mode

The most useful page in the Mixmax help centre is the one about extension conflicts, because it is specific where most vendor troubleshooting is vague.

The general rule Mixmax states is that extensions which modify Gmail can conflict with Mixmax, since Mixmax also modifies Gmail. Two browser extensions rewriting the same interface is a genuine collision rather than a support deflection, and the symptoms it names are the ones people misread as the product being broken: Chrome or Gmail feeling slow, buttons missing from where they should be, or an explicit conflict notification.

Mixmax names ten extensions it knows to conflict, and describes the list as not exhaustive: Cirrus, GoodTime, HubSpot Sales, Mailtrack, NordVPN with CyberSec enabled, Privacy Badger, Rebrandly, Salesflare, Virtru Email Protection and Bullhorn ATS. The NordVPN entry is the interesting one, because disabling CyberSec resolves it without removing the extension. The rest are mostly other sales tools that live in Gmail, which is to say the exact software a sales team already has installed.

The diagnostic Mixmax documents is the cheapest possible test and generalises well beyond this product. Open chrome://extensions, find Mixmax, open its details and enable allow in incognito, making sure no other extension has that setting on. Then open Mixmax in an incognito window. If everything works there, a conflicting extension is the cause, and the remaining work is bisecting the list rather than filing a bug.

1. Step 1Notice the symptom

   Slow Gmail, missing buttons, or an explicit conflict notification

2. Step 2Allow Mixmax in incognito

   From chrome://extensions, with no other extension granted the same

3. Step 3Open Gmail in incognito

   Working there means a conflict, not a Mixmax fault

4. Step 4Check the named list

   Ten extensions are documented as conflicting, and the list is explicitly partial

5. Step 5Disable rather than delete first

   NordVPN resolves by turning CyberSec off, not by removal

Multiple accounts, and the surfaces the extension does not cover

Two operational questions come up immediately after a successful install, and Mixmax documents both.

Working from more than one Google account is the common one, because plenty of people have a personal Gmail signed in alongside their work account, and consultants routinely hold accounts at several clients. Mixmax's installation guidance is that the address you pair should be the one you signed up with, and it maintains a separate help article on working out of multiple Mixmax accounts. The practical trap is Chrome's own multi-account behaviour rather than anything Mixmax does: the extension operates in whichever Chrome profile it is installed in, so a second account in a second profile needs its own install, and a second account signed into the same profile is the configuration most likely to produce confusing half-working states.

The second question is what happens outside Chrome and Gmail. Mixmax publishes a separate Outlook add-in with its own installation path, which is a genuinely different artefact from the Chrome extension rather than the same product in another wrapper. It also maintains a specific answer to whether the product is available on mobile, which is the question every rollout eventually reaches when somebody wants sequences from a phone.

The reason to check both before committing is that a browser extension defines the working surface, and a team split across Gmail and Outlook is really running two deployments. Feature parity between a vendor's browser extension and its add-in is rarely exact, and the differences are the sort of thing that surfaces three weeks after the contract is signed. Ask for the specific feature list per surface rather than assuming the product description covers both.

What the extension model implies for outbound

A browser extension is a per-person, per-machine install, and that shape is the real constraint rather than any individual permission.

It means the tool follows the human. Every seat needs the extension, every new laptop needs it again, and the sending identity is a real person's mailbox rather than a pooled sending resource. For a team of named reps working their own pipeline, that is exactly right, and it is why extension-based tools cluster around tracking, scheduling and light sequencing.

It also means the model does not extend to volume sending, and the reason is architectural rather than commercial. Spreading sends across a rotation of mailboxes is not something a Gmail extension does, because there is no pool for it to rotate across. That work belongs to a platform that owns the sending layer. Cold email software sets the two architectures beside each other, and cold email infrastructure covers what a rotation actually requires. For the commercial side of this specific tool, Mixmax pricing covers which tier carries sequences, and best Mixmax alternatives is the shortlist if the evaluation is heading elsewhere. On the tracking that these permissions exist to power, sender reputation is the constraint worth understanding first.

If the question underneath the evaluation is how to run outbound at volume rather than how to track a rep's mailbox, see what a first campaign looks like.

Features and permissions verified as of August 2026. Verify current terms with the vendor before relying on them.