Chrome Web StoreCaution required
Suspicious in code review (v4.1.1)
Our reviewer found behaviour consistent with malware in version 4.1.1, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
36 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
AI Agent, used by 50,000 people, is rated caution by Extension Auditor. Our code review reported 5 findings (4 high, 1 medium), led by remote code loading. Its permissions mean it can read and change data on all websites and can inject scripts into pages.
Key findings
- High
Remote Code Loading
Every network operation the extension performs is delegated to a hidden iframe loaded from the operator's server: makeRequest (line 196) and makeStreamRequest (line 219) postMessage a MAKE_REQUEST / MAKE_STREAM_REQUEST with an arbitrary URL into that iframe and read back the response, so the fetching logic is remote, mutable at will and never passes CWS review. The same handler also honours an unsolicited {type:'redirect'} message from the iframe with window.open(e.data.redirectUrl) (line 76), giving the server a drive-by navigation primitive, and the iframe is appended to document.body with a shadowRoot-aware document root, the pattern the LayerX AIFrame report describes for this family.
- High
Other
In all three brands that expose it (lines 10-12, 51-53, 92-94) the model labelled 'Claude 4.6 Opus' and sold as model2type 'advanced' resolves to, byte-identical to the 'haiku' endpoint sold as 'standard'. Users paying for the premium tier are routed to the cheap backend, which is deliberate commercial deception rather than a configuration slip, and the surrounding config shows one codebase shipped under five unrelated brand domains all pointing at [domain withheld].
- High
Unauthorized Data Collection
All user chat prompts are sent to [domain withheld] (through the paywall iframe proxy), plus a per-install ext_user_id persisted in chrome.storage.sync as pw-<id>-visitor-id. [domain withheld] is not the publisher's domain, the publisher's privacy policy is an unrelated Google Doc / [domain withheld] link, and the CWS listing declares no data collection at all, so prompt content reaching this third-party operator is wholly undisclosed.
- High
Other
The bundled manifest requests contextMenus in addition to the storage and sidePanel permissions listed in the live CWS manifest summary; host_permissions and externally_connectable otherwise match. contextMenus is UI-only and the divergence most plausibly reflects the summary being captured from a different 4.x build, but it is logged because the bundled and published permission sets are not identical.
- Medium
Privilege Escalation
The service worker exposes an unrestricted bridge letting [domain withheld] read, write and delete arbitrary keys in the extension's chrome.storage.sync, which syncs across all the user's Chrome profiles. Chrome already constrains the caller to the externally_connectable origin, so this is not an open bridge, but combined with the remote-controlled paywall iframe it means the operator holds persistent cross-device write access to extension state including the supabase auth material it stores there.
Analyst notes
Version 4.1.1 is a white-label shell around a server-controlled paywall iframe: builds an iframe at [domain withheld]> and routes every model call through it via MAKE_REQUEST / MAKE_STREAM_REQUEST postMessages, so the code that actually performs the network lives on the operator's server and can change without CWS review. shows the same binary shipped under five brand identities ([domain withheld], sidenox.stream, [domain withheld],) all funnelling to [domain withheld], with the paid-tier 'Claude 4.6 Opus' pointed at the identical endpoint as the cheap 'standard' haiku tier - deliberate premium-tier deception, from a gmail publisher whose listing impersonates Google Gemini, with CWS data collection declared as 'none'. Corroborating: the LayerX AIFrame IoC naming this ID, and a permhash cluster that is 21% flagged malicious. Contradicting / limiting: the Risk-Engine scored this Low, chrome-stats impact is only, there is no obfuscation (the new ML hits are 's isEvalSupported probe in, and are plain React + framer-motion), the contextMenus 'selection' handler in is a no-op, and critically four JS chunks referenced by the bundle are absent from the extract - (the content script's real payload), models., useMessageBridge. and index. - so I cannot verify whether the iframe is injected into arbitrary pages or whether page content is harvested; confidence is medium for that reason. For context only, the live CWS build is now 5.0.1, a full rewrite on different backends ([domain withheld], [domain withheld]) with broader permissions (tabs, scripting, offscreen, <all_urls>).
AI Agent Chrome extension security report
ID: fdlagfnfaheppaigholhoojabfaapnhb
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- airtronics307
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
36 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Google Gemini empowers you with meaningful conversations and instant insights to boost efficiency.
Read the publisher’s full description
Google Gemini: Your Smart Assistant for Chrome Boost your browsing experience with Google Gemini, an advanced AI companion built to make your online life smoother, faster, and more insightful. From quick answers to deep research, from casual chats to professional tasks - Gemini is here to help. 🌟 What Google Gemini Offers: 🧠 Instant AI Support Anytime ⚡ Get clear answers in a single click ⚡ Solve anything from quick questions to complex challenges ⚡ Move across different topics with ease ⚡ Turn browsing into a seamless, intelligent experience with Google Gemini. 💬 Conversations That Inspire 💡 Chat naturally with context-aware replies 💡 Switch between light talk and detailed discussions effortlessly 💡 Receive personalized responses shaped by your needs 💡 Enjoy a flowing, human-like interaction every time ✍️ Unlock Creativity & Productivity ✍️ Draft emails, documents, or stories instantly ✍️ Spark fresh ideas when you’re stuck ✍️ Refine your text with AI-powered suggestions of Google Gemini ✍️ Speed up daily work - whether it’s writing, coding, or brainstorming 🔍 Learn & Explore with Confidence 📚 Get concise explanations on any subject 📚 Simplify complex topics into clear takeaways 📚 Discover new perspectives and concepts 📚 Back up research with accurate, AI-driven insights 🌍 Multilingual Superpower of Google Gemini 🌐 Communicate across languages instantly 🌐 Get context-aware, culturally relevant responses 🌐 Use Gemini to support language learning 🌐 Break language barriers while browsing the web 🚀 How to Start with Google Gemini 📥 Install Gemini from the Chrome Web Store 📥 Open it via the browser icon 📥 Ask your first question or start a conversation 📥 Receive instant answers and support directly in Chrome 💡 Why Google Gemini? ⭐ Smart, context-aware replies tuned to your intent ⭐ Powerful support for creativity, learning, and work ⭐ Flexible features that adapt to your style ⭐ Effortless multilingual communication ⭐ Privacy-first design with Google’s trusted AI Google Gemini isn’t just another browser tool - it’s a powerful AI assistant designed to adapt to your style of work and communication. From quick answers during your daily browsing to deep support for complex projects, Gemini helps you focus on what truly matters. With Gemini, you don’t just interact with AI - you collaborate with it. Each conversation builds a more personalized experience, making your workflow smoother and your creativity limitless. 🏆 Google Gemini’s Unique Advantages 🧠 Transform your browser into a smart, AI-powered companion 🧠 Get personalized insights for learning, creativity, and productivity 🧠 Streamline your workflow with seamless Gemini integration 🧠 Stay ahead with next-generation AI interaction tools 🧠 Benefit from continuous updates shaped by real user feedback 🌈 User-Centric Development with Google Gemini 👥 Regular updates inspired by community suggestions 👥 Join an active user base helping shape Gemini’s roadmap 👥 Continuous improvements to enhance performance and usability 👥 A collaborative approach to AI built with ethics in mind 📘 Clear Guidelines and Reliable Support 📜 Transparent policies for safe and responsible AI use 📜 A detailed FAQ to answer your most common questions 📜 A dedicated support team always ready to assist 📜 A strict privacy policy that keeps your data protected 🚀 Step Into the Future with Google Gemini! Install the Gemini Extension for Chrome today and unlock a new era of intelligent browsing. Whether you’re a student, professional, creator, or simply curious, Gemini empowers your learning, creativity, and productivity. 💡 Key Applications of Google Gemini: 📚 Students: Simplify assignments, research, and study prep 📚 Professionals: Boost writing, accelerate research, and increase efficiency 📚 Creators: Break creative blocks, generate ideas, and refine your work 📚 Everyday Users: Explore new topics, get quick answers, and enjoy meaningful AI-driven chats 🔬 Gemini’s Advanced Technology Framework: ⚡ Natural language processing for smooth, natural interactions ⚡ Machine learning models delivering personalized experiences ⚡ Continuous improvement driven by anonymous feedback ⚡ Lightning-fast responses for a seamless browsing experience 🔮 Exciting Features Coming Soon: 🌟 Integration with more productivity platforms 🌟 Google Gemini supports for images, audio, and multimedia tasks 🌟 Expanded customization for a tailored experience 🌟 Collaboration tools for teams and shared projects 🌍 Our Commitment: By choosing Google Gemini, you’re not only upgrading your browsing—you’re also supporting ethical AI development. We are dedicated to privacy, responsibility, and advancing the positive role of AI in daily life. 📧 Questions or suggestions? We’d love to hear from you! Contact us at: gemini.online.one@gmail.com 🔥 Download Google Gemini now and experience the power of AI-enhanced browsing. Unlock your potential with Google’s most advanced technology at your fingertips!
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
36 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in Tools
- Montara Chrome Extension639,000,000 users
- 迅雷下载支持86,000,000 users
- Claude19,000,000 users
- Zotero Connector9,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users