[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

ChatGPT

Version 1.2.27221.15725 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Rating: 3.4 ★ (407 ratings)

Users: 2,000,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 9 total findings, including 7 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: bookmarks

This extension has the bookmarks permission. Can access and modify bookmarks. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: debugger

This extension has the debugger permission. Can debug and manipulate other extensions/apps. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: history

This extension has the history permission. Can access your browsing history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

alarms
bookmarks
debugger
downloads
favicon
history
nativeMessaging
notifications
scripting
sessions
storage
tabGroups
tabs
topSites
webNavigation
sidePanel

Optional Permissions:

downloads.open

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self'; object-src 'none'; connect-src 'self' http://127.0.0.1:* http://localhost:* ws://127.0.0.1:* ws://localhost:* https://ab.chatgpt.com https://chatgpt.com; font-src 'self' https://cdn.openai.com;

Embedded URLs (163 total):

https://tailwindcss.com	https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-Regular.woff2
https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-RegularItalic.woff2	https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-Medium.woff2
https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-MediumItalic.woff2	https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-Semibold.woff2
https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-SemiboldItalic.woff2	https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-Bold.woff2
https://cdn.openai.com/common/fonts/openai-sans/v2/OpenAISans-BoldItalic.woff2	https://github.com/wxt-dev/wxt/issues/371
https://wxt.dev/guide/go-further/testing.html	http://www.w3.org/2000/svg
https://github.com/kosua20/Rendu	https://github.com/molstar/molstar/blob/master/src/mol-gl/shader/fxaa.frag.ts
http://mrl.nyu.edu/~dzorin/cg05/lecture12.pdf	http://stackoverflow.com/questions/9595300/cylinder-impostor-in-glsl
https://files.rcsb.org/view/	https://pubchem.ncbi.nlm.nih.gov/rest/pug/compound/cid/
https://models.rcsb.org/	https://bit.ly/3cXEKWf
https://docs.google.com/	https://chatgpt.com/cyber
https://github.com/mermaid-js/mermaid/issues.	http://www.w3.org/1999/xlink
http://www.w3.org/1999/xhtml	http://www.w3.org/XML/1998/namespace
https://www.google.com/search?	https://api.openai.com/auth
https://api.openai.com/profile	https://chatgpt.com/backend-api
https://github.com/openai/codex/issues/new?template=1-codex-app.yml&steps=	https://github.com/openai/codex/issues
https://chatgpt.com/ces/v1/rgstr	https://chatgpt.com/ces/v1
https://ab.chatgpt.com/v1	https://ab.chatgpt.com/v1/sdk_exception
https://openai.com/codex/	https://persistent.oaistatic.com/codex-app-prod/ChatGPT.dmg
https://get.microsoft.com/installer/download/9PLM9XGG6VKS?cid=website_cta_psi	https://codex.local
https://mail.google.com/mail/u/0/?tf=cm	https://outlook.office.com/mail/deeplink/compose?to=
https://www.google.com/s2/favicons?domain=	https://www.googleapis.com/auth/gmail.modify
https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance	http://www.w3.org/1998/Math/MathML
https://chevrotain.io/docs/guide/resolving_lexer_errors.html#COMPLEMENT	https://chevrotain.io/docs/guide/resolving_lexer_errors.html#REGEXP_PARSING
https://github.com/chevrotain/chevrotain/issues	https://chevrotain.io/docs/guide/resolving_lexer_errors.html#UNICODE_OPTIMIZE
https://chevrotain.io/docs/guide/resolving_lexer_errors.html#CUSTOM_OPTIMIZE	https://chevrotain.io/docs/guide/resolving_lexer_errors.html#ANCHORS
https://chevrotain.io/docs/guide/resolving_lexer_errors.html#UNREACHABLE	https://chevrotain.io/docs/guide/resolving_lexer_errors.html#LINE_BREAKS
https://chevrotain.io/docs/guide/resolving_lexer_errors.html#IDENTIFY_TERMINATOR	https://chevrotain.io/docs/guide/resolving_lexer_errors.html#CUSTOM_LINE_BREAK
https://chevrotain.io/docs/guide/resolving_lexer_errors.html#MISSING_LINE_TERM_CHARS	https://github.com/chevrotain/chevrotain/issues/564#issuecomment-349062346
https://chevrotain.io/docs/FAQ.html#NUMERICAL_SUFFIXES	https://chevrotain.io/docs/guide/resolving_grammar_errors.html#COMMON_PREFIX
https://chevrotain.io/docs/guide/resolving_grammar_errors.html#AMBIGUOUS_ALTERNATIVES	https://en.wikipedia.org/wiki/LL_parser#Left_factoring.
https://chevrotain.io/docs/changes/BREAKING_CHANGES.html#_6-0-0	https://chevrotain.io/docs/changes/BREAKING_CHANGES.html#_4-0-0
https://chevrotain.io/docs/guide/internals.html#grammar-recording	https://chevrotain.io/docs/guide/resolving_grammar_errors.html#IGNORING_AMBIGUITIES
https://langium.org/docs/reference/configuration-services/#resolving-cyclic-dependencies	https://github.com/mermaid-js/mermaid
https://reactrouter.com/en/main/routers/picking-a-router.	https://react.dev/errors/
https://radix-ui.com/primitives/docs/components/	https://help.openai.com/en/articles/11369540-using-codex-with-your-chatgpt-plan#h_8dd84c836b
https://openai.com/chatgpt/pricing	https://github.com/mermaid-js/mermaid/releases/tag/v11.0.0
http://example.com	https://foo.bar
https://github.com/wojtekmaj/react-pdf#support-for-annotations	https://github.com/wojtekmaj/react-pdf#support-for-text-layer
https://github.com/	https://example.com

Page 1 of 3

Raw Manifest

{
  "name": "ChatGPT",
  "icons": {
    "16": "images/icon16.png",
    "32": "images/icon32.png",
    "128": "images/icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "images/icon16.png",
      "32": "images/icon32.png",
      "48": "images/icon48.png"
    },
    "default_title": "ChatGPT"
  },
  "version": "1.2.27221.15725",
  "commands": {
    "open-codex-side-panel": {
      "description": "Open ChatGPT side panel",
      "suggested_key": {
        "mac": "Command+Shift+Period",
        "default": "Ctrl+Shift+Period"
      }
    }
  },
  "background": {
    "service_worker": "background.js"
  },
  "side_panel": {
    "default_path": "codex-sidepanel/index.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Control Chrome with ChatGPT.",
  "permissions": [
    "alarms",
    "bookmarks",
    "debugger",
    "downloads",
    "favicon",
    "history",
    "nativeMessaging",
    "notifications",
    "scripting",
    "sessions",
    "storage",
    "tabGroups",
    "tabs",
    "topSites",
    "webNavigation",
    "sidePanel"
  ],
  "content_scripts": [],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "downloads.open"
  ],
  "minimum_chrome_version": "116",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'none'; connect-src 'self' http://127.0.0.1:* http://localhost:* ws://127.0.0.1:* ws://localhost:* https://ab.chatgpt.com https://chatgpt.com; font-src 'self' https://cdn.openai.com;"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "images/cursor-chat.png"
      ]
    }
  ]
}

by ✦ Astarte

ChatGPT

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (163 total):

Raw Manifest

Detections

Manifest Findings