Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Grok AI, used by 20,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by unauthorized data collection. It comes from a trusted publisher and was last updated in October 2025.
Key findings
- Medium
Unauthorized Data Collection
A postMessage from the remote origin [domain withheld] makes the extension scrape the user's active tab and hand the result to that same remote page (postMessageToIframe, line 1320). The scraper itself is:99, whose injected function returns location.href, document.title, the favicon URL and the entire visible text of document.body, so any authenticated page the user happens to be viewing (webmail, banking, internal tools) is readable. Consent is a single broad optional <all_urls>+scripting grant (helpers N()/A(), lines 145-190): once granted they return true with no further prompt, gesture check or UI indication, so the timing of every subsequent scrape is decided server-side by an operator unaffiliated with xAI, while the CWS listing declares no data collection whatsoever.
Analyst notes
The bundle is a thin, unobfuscated iframe wrapper: every page (,,) loads [domain withheld] in an iframe (:950-972, createOptimizedUrl returns the fixed URL with no appended), and all chat happens on that operator's site, so prompt content necessarily leaves the browser to a third party by design. The one code-level concern is a remote-origin-controlled page scraper: a postMessage from [domain withheld] triggers handlePageContentRequest (iframe-service:1236), which after a one-time optional <all_urls>+scripting grant has:99 executeScript-extract the active tab's full visible text, URL, title and favicon and postMessage it back to the operator (iframe-service:1320) with no per-use gesture, while the CWS listing declares no data collection at all. Contradicting the signals: chrome-stats scores impact, Google's trusted-publisher badge and featured status apply, there is no obfuscation, no access and nothing that harvests API keys as the cited Obsidian article describes; the ML pattern hits are benign (12 innerHTML are static overlay templates on the extension's own #systemOverlay at iframe-service:, and the single uses_scripting_execute_script_dynamic is the page-text reader). Corroborating suspicion::12-38 configures six brand-lookalike frontends (chatgpt-5, grok-ai, grok-3, deepseek-ai, perplexity-ai, gemini-2) on one operator domain, so the 'only extension by this publisher' reputation is understated, and the Grok branding impersonates xAI despite an in-description disclaimer.
Grok AI Chrome extension security report
ID: hafhkoalnlpoifpidohfjlmeemfifndi
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- joldeveloply@gmail.com
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
With Grok AI, you can boost your workflow with fast answers from grok ai and accelerate your success using the grok model.
Read the publisher’s full description
💡 Sidebar with Grok AI — the intelligent assistant that transforms how you interact with code, and everyday tasks. Unlock creativity, streamline your workflow, transform your digital experience with this model. Available models (also accessible via the extension): Claude Sonnet, Gemini, ChatGPT, DeepSeek etc. This extension is not officially developed by XAI but provides access to its models 📌 Versatile Grok AI Use Cases: ➤ Solves coding challenges and generates snippets with grok3 or grok2 power. ➤ Gives cloud realizations, keeping you updated with grok ai trends and smart records. ➤ Tool automates processes with assistant efficiency, powered by tesla grok precision. ➤ App integrates digital life with model versatility, upgrading every routine task. 🌟 Why Choose Assistant? 1️⃣ Grok AI streamlines mundane, repetitive tasks so you can fully focus on key goals. 2️⃣ X ai delivers natural, context-aware dialogue to simplify all your daily inquiries. 3️⃣ Adapts its responses to local dialects grok intelligence, ensuring precise support everywhere. 🔥 Embrace the Future with Grok AI As technology evolves, staying ahead means embracing adaptive tools. Empowers your success with real-time problem solving, creative project enhancements by Grok AI — your partner in achieving excellence. 📍 Interactive Learning and Broaden academic horizons Grok with immersive lessons that simplify complex topics plus spark engagement. Gronk ai offers real-time Q&A along with tailored guidance to energize each study session. Discover groc ai features uniquely designed to boost your educational journey, inspire critical thinking. ⚡ Supercharge your professional utility ▸ Groc AI delivers instant analysis with structured data for research, coding, ideas. ▸ Expertly manages emails, schedules, lists to streamline your daily routines by gronk ai. ▸ Transforms lessons by grok chatbot into dynamic, interactive sessions for engaging education. 📍 Meet the smartest chat. Download the Grok Chat extension and embrace the present with hidden insights and smarter search powered by breakthrough technology. Driven by gronk ai innovation, grok chat transforms education, work, creativity, personal growth to meet all your needs. 💼 Enhanced Security and Reliability • Advanced encryption protocols in grock ai reliably secure your projects and sensitive data. • Continuous updates and rigorous tests in grok3 fortify digital assets against breaches. • Strict monitoring and proactive fixes in grok maintain peak security, privacy always. • Robust data handling in groc defends against threats, ensuring compliance and trust. 🚀 Community-Driven Enhancements Grok AI success shines in glowing testimonials from a growing community. Use faster decisions, improved workflow, and boosted creativity thanks to context-aware dialogue together with real-time solutions. Community contributions drive continuous innovation and trust. 📌 Continuous Innovation - Grok AI evolves constantly with regular feature enhancements and refined UI upgrades! - Seamless IoT and machine learning integration ensures a future-ready, innovative platform. - Personalized workflow automation and enhanced voice recognition tailor your needs. - Predictive analytics aptly anticipate future challenges, keeping your business ahead. 🎁 Download Chat Today Unlock creativity, streamline your workflow, transform your digital experience by grok chatbot. Discover a tool that redefines success in today’s tech-driven world. 🔥 Embrace Excellence Embrace the future of intelligent assistance by Grok AI. Enhance productivity, secure your digital life, gain smart strategies to overcome modern challenges. Experience seamless integration with precision-engineered features that elevate your professional journey. Boosting productivity: 🔹 Gronk AI tailors clear answers for every need; 🔹 Xai Grok sharpens context and fuels smart replies; 🔹 Elon Musk AI drives deep insights and smart tips; 🧩 Download the extension now and discover a world where intelligent assistance is always at your fingertips.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools347,000,000 users
- Application Launcher For Drive (by Google)100,000,000 users
- AdBlock — block ads across the web65,000,000 users
- Chrome Remote Desktop41,000,000 users
- Adblock Plus - free ad blocker40,000,000 users