Drive shows the source.
This shows the page.
Open an HTML file in Google Drive and you get a wall of markup. Drive retired its own web hosting in 2016 and no setting brings it back, so the fix has to run in the browser.
What Drive gives you
<!doctype html> <html lang="en"> <style> body { font: 16px/1.6 } h1 { letter-spacing: -.02em } </style> <h1>Quarterly report</h1> <p>Three routes remain open.</p>
What this gives you
Quarterly report
Three routes remain open.
What it asks for
No OAuth, no consent screen, no Drive API scopes. The extension reads the file with the Google session already in your browser, and renders it on your own machine.
- Permissions
storage, plusdrive.google.comanddrive.usercontent.google.com. Nothing else.- Network
- One request, to Drive, for the file you opened. No server, no analytics, no telemetry.
- Isolation
- Your file runs in a sandboxed frame on an opaque origin, with no access to extension APIs, extension storage, or your cookies.
- Size
- About 21 KB. No dependencies, no build step.
Before you install something that reads your files
How does it know which file I opened?
Drive opens most files in an overlay on top of the folder, which leaves both the URL and the page title unchanged. So the file has to be identified from Google's own markup, and that markup can be rearranged without notice.
Three separate checks have to agree before anything renders: the visible dialog has to name an HTML file, one selected row and no others has to carry both a Drive file id and that same name, and the filename Drive returns in the download response has to match what the page claimed. Any disagreement and the extension does nothing, which leaves Drive as it was.
Can it render the wrong file?
Showing you someone else's document would be worse than showing you nothing, so that is the case the checks are built around. The third check is the backstop: the file's real name, taken from the HTTP response rather than the page, has to match. The extension refuses a file whose identity it cannot verify.
What does it not do?
Multi-file sites are out of scope. HTML that references sibling Drive files for CSS, JavaScript or images will not resolve them. The extension expects a self-contained file, with everything inline or loaded from public CDNs.
A file served without a character set, or with the wrong one, may render as
mojibake. A bare /file/d/<id> URL with no trailing segment is not
recognised. The README has the full list.
Can a page I open send data somewhere?
Yes. The extension itself transmits nothing, but a document you open can reference scripts, fonts or images from third-party servers and make its own requests, as it could in any browser tab. The extension does not block that.
The document runs in a sandboxed frame, so it can reach its own author's servers and nothing belonging to you. The privacy policy covers this. Read it here.
Does it work in Brave?
Yes, tested with default shields. Brave matters on its own here: shields affect cookies, and the Google session cookie is the only thing authenticating the download. There is no OAuth fallback.