Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: ChatGPT Search for Chrome™

CRITICAL RISKRemoved from Chrome Web Store

ChatGPT Search for Chrome™

ID: oghbffaoaooigagpockijkpfpgmnibkh

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.61.1444.0

Size

0.42 MB

Rating

4.5/5

Reviews

Users

50,000

Type

Extension

Updated

Jun 7, 2024

Publisher Contextual Analysis

Author: https://aiforchrome.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

52,092

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

With ChatGPT Search for Chrome™, you can quickly search for answers with a smart ChatGPT chat.

Our extension is designed to enhance your online search experience, make it personalized and learn more about the things you enjoy. Advanced AI technology will provide you with instant, personalized responses and assistance whenever you choose. This extension is your all-in-one solution for effortless and intelligent searching of the web. Discover the power of instant searching with AI. Effortlessly toggle the option to ask ChatGPT in the search suggestion dropdown. We never collect personally identifiable information. To learn more about our data collection, check out our privacy policy linked in the Chrome Web Store. By adding the extension to Chrome, you are agreeing to the conditions laid out in the privacy policy. The extension switches your default search in order to provide searching with AI.

User Growth

Showing data from Oct 29, 2024 to Apr 14, 2025

Versions

+66.67%(+20,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 2 ratings

Average Rating

Current: 4.50 / 5.0+4.50

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High7

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.61.1444.0 Code review	10

Extension Version	Code Review Findings
1.61.1444.0	10

Files with findings

2 distinct paths — top paths by unique finding count:

bg.js9
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	bg.js (line 6439)	Registers webRequest listeners on <all_urls> across main_frame, sub_frame, stylesheet, script, image, object, xmlhttprequest, ping and other — including request and response headers (extraHeaders when available). Effe…	1.61.1444.0
2	Remote Code Loading	critical	bg.js (line 2598)	Function L is injected into arbitrary tabs via executeScript. It creates an attacker-controlled iframe (src supplied at runtime by the C2 server) and exposes a full DOM-manipulation RPC over postMessage: create elemen…	1.61.1444.0
3	Remote Code Loading	critical	bg.js (line 1553)	After every 'hit' call to the /api/aigpt/hit endpoint on ext.withaiforchrome.com, the response's 'lst' field is treated as a list of tasks. Each task has a type/id/deferMs and is dispatched through a registry of handl…	1.61.1444.0
4	Code Injection	high	bg.js (line 2554)	Generic wrapper that executes arbitrary functions in any tab via chrome.scripting.executeScript with dynamic func and args. Combined with <all_urls> host permissions, this lets the background script inject code into a…	1.61.1444.0
5	Credential Theft	high	bg.js (line 4077)	Exposes cookies.getAll and cookies.getAllCookieStores wrappers. Combined with <all_urls> host permissions this can read every authentication cookie in the browser (session/auth tokens for any site), which — together w…	1.61.1444.0
6	Network Interception	high	bg.js (line 6116)	Registers a webRequest onBeforeRequest listener on <all_urls> main_frame navigations, parses the 'q' query string of every top-level navigation, and if it contains the @@aigpt@@ sentinel redirects the user to https://…	1.61.1444.0
7	Obfuscation	high	bg.js (line 2071)	POST bodies to the attacker backend are XOR-encoded (key 0xFF) and base64-wrapped, with a custom 'application/x-binary' content type, rather than sent as plain JSON. This obfuscation has no functional purpose other th…	1.61.1444.0
8	Tracking	high	bg.js (line 1736)	Silently reads chrome.topSites (the user's most-visited URLs) and attaches them as 'tops' to outbound telemetry. The list of actions that suppress this can be remotely configured via noTsActions, but by default browsi…	1.61.1444.0
9	Tracking	high	manifest.json (line 15)	Forcibly sets the user's default search engine to attacker-controlled search.withaiforchrome.com with is_default:true, and routes all search suggestions through ext.withaiforchrome.com/api/aigpt/suggest. Combined with…	1.61.1444.0
10	Unauthorized Data Collection	high	bg.js (line 1692)	On every telemetry hit the extension harvests a rich device/user fingerprint — navigator.language, local time, timezone, whether chrome.management is available, full manifest permissions list, runtime id, active tab i…	1.61.1444.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


withaiforchrome.com	-	https://withaiforchrome.com
www.aiforchrome.com	-	https://www.aiforchrome.com
ext.withaiforchrome.com	-	https://ext.withaiforchrome.com
ext.aiagentforchrome.com	-	https://ext.aiagentforchrome.com
www.aiforchrome.com	/feedback.html	https://www.aiforchrome.com/feedback.html
chat.withaiforchrome.com	/chatgpt_lp	https://chat.withaiforchrome.com/chatgpt_lp?q=
unknow.com	-	http://unknow.com
ext.withaiforchrome.com	/src/bg.js.d73210c36a3629bc363c.map	https://ext.withaiforchrome.com/src/bg.js.d73210c36a3629bc363c.map
ext.withaiforchrome.com	/src/style.css.d73210c36a3629bc363c.map*/	https://ext.withaiforchrome.com/src/style.css.d73210c36a3629bc363c.map*/
npms.io	/search	https://npms.io/search?q=ponyfill.

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

ChatGPT Search for Chrome™

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating