What our analysis found

Gemini™ for Chrome, used by 100,000 people, is rated malicious by Extension Auditor. Our code review reported 5 findings (4 critical, 1 high), led by unauthorized data collection. Its permissions mean it can observe network requests.

Key findings

• Critical

  Unauthorized Data Collection

  The service worker writes CONSENT_STATE:"agreed" and LDP_ACTIVE_STATUS:"on" on every load and then overrides chrome.storage.local.get so that any read of those keys returns the forced values regardless of what the user actually chose — consent can never read as withheld. The bundled consent screen () tells the user the purpose is to "enable integrated AI anonymization … to de-identify your prompts and avoid personal data leakage", yet the same object force-disables that exact feature with LLM_DATA_PROTECTION_STATUS:"off". The code comment states the bypass of the consent flow outright.

  Show more — Unauthorized Data Collection
• Critical

  Unauthorized Data Collection

  A page-world collector patches window.fetch, and WebSocket, and additionally installs DOM MutationObservers for ChatGPT, DeepSeek, Meta AI and Grok, to capture both the user's prompt and the assistant's full response on all eight supported AI platforms. This runs passively on every conversation turn — it is not gated on the user invoking the 'Optimize' action, which is the only function the listing describes and the only one that would need prompt text. The CWS listing declares no data collection whatsoever, so harvesting entire AI conversations (which routinely contain personal, financial and work-confidential text) is wholly undisclosed.

  Show more — Unauthorized Data Collection
• Critical

  Data Exfiltration

  Captured prompts and model responses from both collectors (SB_CONTEXT_CAPTURE from the page collector, and 401_DATA…408_DATA relayed from the panel executors via queueLdpContextMessage at:3271) are AES-GCM encrypted and POSTed to on [domain withheld], in batches of up to 1000 items / 768 KB per request, with up to 10,000 items / 64 MB queued locally (CONTEXT_BATCH_MAX_STORED_BYTES,:80). The destination is the publisher's own domain, but the exported data category — the complete content of the user's AI conversations — is absent from the CWS data-collection disclosure ('none declared'), and no in-product control exposes or disables this upload.

  Show more — Data Exfiltration
• Critical

  Data Exfiltration

  Eight web-accessible 'executor' scripts (401-408, one per AI platform) are injected into the page world where they wrap, parse the outgoing request body for the user's prompt (truncated to DATA_LIMIT 10,000 chars,:94) and read the SSE response stream for the model's reply (30,000 chars, line 88), then postMessage them out as 401_DATA…408_DATA. The tickets these build carry panelistId, partnerId, distributorId and panelId:4 (:200-213) — market-research panel fields that have no role in prompt optimisation and confirm the payload is conversation telemetry, not a product feature. relays these to the service worker, which queues them into the same undisclosed upload.

  Show more — Data Exfiltration
• High

  Other

  The bundled manifest requests webRequest, tabs and alarms; the live CWS listing summary instead shows contextMenus and declarativeNetRequest with no webRequest or tabs, and exposes web_accessible_resources of "*" to extension_ids "*" over <all_urls>, which the bundle does not. Because the two snapshots may be different versions, this is reported as manifest drift rather than proof of a delayed-malicious push, but the delta is material: webRequest is live in this build (:1736-1752 registers listeners) and is not in the published set. Separately, the listing presents this as "Gemini™ for Chrome" while the bundle is "Prompt Optimizer - SecondBrain" instrumenting eight competing AI platforms — a listing-alignment mismatch in its own right.

  Show more — Other