Chrome Web Store
16Versions
4Code reviewed

No malware found

In code review (v1.1.4)

Our reviewer read version 1.1.4 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

AI Chat Exporter - ChatGPT, Claude, Gemini & DeepSeek to PDF, used by 3,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 medium), led by unauthorized data collection. Its permissions mean it can read and change data on all websites and can inject scripts into pages.

Key findings

  • Medium

    Unauthorized Data Collection

    The default PDF export path uploads the entire conversation - every user prompt and model reply, plus inlined base64 images and the chat page URL (options.baseUrl = window.location.href) - to the publisher's Cloud Run backend for server-side Puppeteer rendering; client-side html2pdf runs only as a fallback, since:951 comments the flow as 'Try server-side PDF generation first'. Every export, including pure-markdown ones that need no server at all, additionally POSTs title, filename, format and the chat source_url to (.js:309), and all of it is keyed to a persistent per-install UUID held in chrome.storage.sync and sent as X-Client-ID, readable back through The destination is the publisher's own first-party API and the server-render feature is plausibly necessary, so this is not exfiltration to a third party, but the CWS listing declares no data collection whatsoever, so transmission of full AI conversation contents and the chat URLs off the device is entirely undisclosed to the user at install time.

Analyst notes

The code is a coherent AI-chat-to-PDF exporter in which every data flow is user-initiated from an injected export button, the only first-party backend is the publisher's own Cloud Run API used for Puppeteer PDF rendering, quota and Stripe checkout, and the chrome.identity OAuth tokens (Drive drive.file, Dropbox, Yandex, Notion) are stored locally and sent only to their own provider APIs - never to the publisher; the site credentials read from page storage (:13,:11,:45) are used solely as Authorization headers against those same sites' own conversation-history endpoints. There is no autonomous collection: the two MutationObservers (:420,:845) only re-inject the export button on SPA navigation, and there are no alarms, webNavigation, chrome.cookies, executeScript, eval or remote script loads, which contradicts the ML score, as does the fact that the malware label and the 'publisher malicious' figure both derive from the same malext feed import that the internal note itself calls 'not an independent code review'. Held at likely_benign rather than false_positive because CWS data collection is declared as 'none' while the default export path uploads full conversation HTML to the publisher's server (the one finding below), because confidence is capped by two signed code files absent from this bundle, and because the bundled manifest adds <all_urls> that the live listing lacks - a grant this bundle's code exercises only through the generic fetch_image CDN proxy at:230, so the mismatch conceals no undisclosed behaviour in the code reviewed, but it is broader than that proxy needs.

AI Chat Exporter - ChatGPT, Claude, Gemini & DeepSeek to PDF

AI Chat Exporter - ChatGPT, Claude, Gemini & DeepSeek to PDF Chrome extension security report

ID: dhjbkabkopajddjinfdlooppcajoclag

Supported Languages

🇪🇹Amharic
🇸🇦Arabic
🇧🇩Bengali
🇧🇷Brazilian Portuguese
🇬🇧British English
🇧🇬Bulgarian
🇪🇸Catalan
🇨🇳Chinese (Simplified)
🇹🇼Chinese (Traditional)
🇭🇷Croatian
🇨🇿Czech
🇩🇰Danish
🇳🇱Dutch
🇺🇸English
🇪🇪Estonian
🇵🇭Filipino
🇫🇮Finnish
🇫🇷French
🇩🇪German
🇬🇷Greek
🇮🇳Gujarati
🇮🇱Hebrew
🇮🇳Hindi
🇭🇺Hungarian
🇮🇩Indonesian
🇮🇹Italian
🇯🇵Japanese
🇮🇳Kannada
🇰🇷Korean
🇲🇽Latin American Spanish
🇱🇻Latvian
🇱🇹Lithuanian
🇲🇾Malay
🇮🇳Malayalam
🇮🇳Marathi
🇳🇴Norwegian
🇮🇷Persian
🇵🇱Polish
🇵🇹Portuguese
🇷🇴Romanian
🇷🇺Russian
🇷🇸Serbian
🇸🇰Slovak
🇸🇮Slovenian
🇪🇸Spanish
🇰🇪Swahili
🇸🇪Swedish
🇮🇳Tamil
🇮🇳Telugu
🇹🇭Thai
🇹🇷Turkish
🇺🇦Ukrainian
🇺🇸US English
🇻🇳Vietnamese

Extension Info & Metadata

Status
Active
Version
1.1.5
Size
6.01 MB
Rating
4.3/5
Reviews
84
Users
3,000
Type
Extension
Updated
Oct 13, 2026
Category
Tools
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
26extensions
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
Neo Cortex LLC
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Extensions
26
Active
26
Obsolete
0
Listed
26
Unlisted
0
Users
13,848

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5

Install growth

Item
Type
Severity
Description
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
identity
Permission
High
This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: • 19% increase: Access to sensitive domains increases potential impact • 10% increase: Early script execution enables pre-emptive content manipulation
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
https://chatgpt.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://chat.openai.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://claude.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://venice.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://chat.deepseek.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://grok.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.twitter.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.x.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.x.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.twimg.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://copilot.microsoft.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://copilot.cloud.microsoft/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.copilot.cloud.microsoft/*
Host
Medium
Host permission — access limited to this URL pattern.
https://m365.cloud.microsoft/*
Host
Medium
Host permission — access limited to this URL pattern.
https://m365.microsoft.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://copilot.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.copilot.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://github.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://api.github.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://aistudio.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://gemini.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.googleusercontent.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.oaiusercontent.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.a.run.app/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.googleapis.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://content.dropboxapi.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://api.dropboxapi.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://api.notion.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://assets.grok.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://assets.claude.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.claudemcpcontent.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.deepseek.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.perplexity.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://cocounsel.thomsonreuters.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.amazonaws.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://cloud-api.yandex.net/*
Host
Medium
Host permission — access limited to this URL pattern.
https://oauth.yandex.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://oauth.yandex.ru/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://*.twitter.com/*, https://github.com/*, https://api.github.com/*, https://aistudio.google.com/*, https://gemini.google.com/*, https://*.googleusercontent.com/*, https://*.google.com/*, https://www.googleapis.com/*, https://*.amazonaws.com/*
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
downloads.open
Permission
Low
This permission opens downloaded files. Rated Low because it can only open files after explicit user download and selection.

About this extension

Export ChatGPT, Claude, Gemini, DeepSeek, Grok to PDF. Batch save chats with code, math & images. Export your AI history.

Read the publisher’s full description

🚀 Export ChatGPT, Claude, Gemini & more to PDF in seconds If you’ve ever worried about losing an important AI conversation, this extension makes it easy to keep a copy. AI Chat Exporter lets you save chats as PDF, Markdown, or JSON with one click — including code, images, math, and formatting. No copy-paste. No screenshots. No messy print-to-PDF workarounds. 📸 CLEAN, ACCURATE EXPORTS Instead of producing broken or ugly PDFs, AI Chat Exporter saves your conversation exactly as you see it: • Code blocks keep their syntax highlighting • Tables, math (LaTeX), and structured content stay intact • Images and attachments are included • Links, headings, and formatting are preserved • The original layout remains readable • Even very long chats export properly Your files come out clean and easy to read, perfect for sharing, archiving, or revisiting later. 🤖 WORKS WITH ALL MAJOR AI TOOLS Save conversations from: • ChatGPT (including Canvas & GPT-4o) • Claude (including Artifacts) • Google Gemini & AI Studio • Perplexity AI & Venice AI • DeepSeek & Grok • Microsoft Copilot & GitHub Copilot You don’t need separate extensions for each platform. ⚡ FEATURES YOU’LL ACTUALLY USE • One-Click Export — Save the current chat instantly • Batch Export — Archive multiple conversations at once • Multiple Formats — PDF, Markdown (.md), JSON, or Plain Text • Cloud Sync (Pro) — Optional backup to Google Drive or Dropbox • Formatting Preserved — Headers, lists, links, and styles stay intact • High-Quality PDFs — No cut-off pages or broken layouts • Works Offline — Export without an internet connection • No Tracking — No analytics or data collection 🔒 BUILT WITH PRIVACY IN MIND Your conversations stay on your device. • No account required • No uploads to external servers • No tracking or telemetry • Everything processed locally This makes it suitable for sensitive work, research, or personal conversations. 🛠️ WHO IT’S FOR 👨‍💻 Developers — Save useful code and debugging sessions 🎓 Students — Keep research and study material organized ✍️ Writers & Creators — Store ideas, drafts, and scripts 📊 Professionals — Document planning sessions and workflows 🧠 Researchers — Preserve long, detailed discussions ☁️ FREE & PRO OPTIONS The free version includes daily exports, so you can start saving chats right away. Pro adds: • Unlimited exports • Automatic cloud backup • Additional export settings • Theme customization • Priority feature updates ⭐ WHY PEOPLE USE AI CHAT EXPORTER ✔ Fast and reliable, even for very long conversations ✔ Much cleaner than printing or copy-pasting ✔ Works across multiple AI platforms ✔ Designed for frequent use ✔ Lightweight and simple 📥 Install AI Chat Exporter and keep your important AI conversations safe.

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
1.1.5
Latest
6.01 MBCaution—
8468300d2792ae762b4df166193f7c5963520c3fc5f89d86587b09015d7575c0
1.1.4
5.71 MBNo malware found0
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.1.3
5.70 MBNot scanned—
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.1.2
4.39 MBNot scanned—
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.1.1
4.37 MBNo malware found0
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.1.0
4.35 MBNo malware found0
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.0.9
3.84 MBNot scanned—
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.0.8
3.83 MBNot scanned—
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.0.7
3.79 MBNot scanned—
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
1.0.6
3.79 MBNot scanned—
3d9c0b3f6f593461e07c367108cfeedee0c99251dbefd782b323e79b8947ef0d
Showing 1 to 10 of 20 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Store rankings

Where this extension appears in store category, collection and keyword rankings.