Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
2 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
AI Assistant, used by 1,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (2 medium), led by code injection. It comes from a publisher with 2 extensions and was last updated in April 2023.
Key findings
- Medium
Code Injection
The modal's `setContent` method passes the raw GPT API response string to jQuery's `.html()`, which parses and renders it as live HTML in the DOM of every page the user visits. Because the response originates from a publisher-controlled AWS Lambda endpoint (`[domain withheld]`), a backend change could silently inject arbitrary HTML or JavaScript into any tab where the modal has been invoked. This risk is materially elevated by the publisher's 100% malicious rate on their other extensions.
- Medium
Unauthorized Data Collection
All user queries, typed prompts, and page URLs (for Page actions) are POSTed to a publisher-controlled AWS Lambda endpoint. The CWS listing explicitly declares no data collection, making this transmission undisclosed. The endpoint has no brand affiliation stated anywhere in the extension or the privacy policy, and is not a known AI SaaS provider (OpenAI, Anthropic, etc.) — it is solely controlled by a publisher with a fully malicious track record on their other extensions.
Analyst notes
The extension's code is readable and functionally consistent with its stated purpose as an AI assistant; there is no obfuscation, credential harvesting, or covert exfiltration. However, two concrete concerns elevate it: (1) the content script renders the GPT API response directly as HTML into every visited page's DOM via jQuery's `.html()` (:44), giving the publisher's backend — a generic AWS Lambda with no disclosed identity — a persistent code-injection vector into all pages, and (2) user queries and page URLs are transmitted to that publisher-controlled endpoint with zero data collection disclosed in the CWS listing. The publisher's 100% malicious rate on their other extensions () significantly amplifies both risks. The ML score (0.54), low rating, and low user count corroborate concern; the clean permission set and use of legitimate ExtPay billing contradict it.
AI Assistant Chrome extension security report
ID: manahiemhgolofngagbjjefiibejhcgm
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Castusoft
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 2904 Chaise Ln Maineville, OH 45039-9038 US
Screenshots & videos
Install growth
- 2 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
2 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
AI Assistant helps you answer question, summarize and explain pages and texts!
Read the publisher’s full description
Introducing the revolutionary AI Assistance that will transform the way you browse the web! With this powerful tool at your fingertips, you can quickly and easily summarize any page, get in-depth explanations of complex concepts, and even get answers to your burning questions. Gone are the days of sifting through endless pages of information, trying to find the needle in the haystack. Our AI extension leverages cutting-edge natural language processing and machine learning algorithms to deliver the most relevant and useful information to you in seconds. Whether you're a student, professional, or just a curious individual, this extension will save you time and effort while providing valuable insights and knowledge. With its user-friendly interface and lightning-fast performance, it's the perfect tool for anyone who wants to stay on top of the latest trends and developments in their field. So why wait? Download AI Assistant extension today and take your browsing experience to the next level! Don't forget to relaunch your page after download!
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
2 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from Castusoft
- Castusoft Auto-Booker124 users
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools347,000,000 users
- Application Launcher For Drive (by Google)101,000,000 users
- AdBlock — block ads across the web65,000,000 users
- Chrome Remote Desktop41,000,000 users
- Adblock Plus - free ad blocker40,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.