Chrome Web Store
38Versions
1Code reviewed

Caution required

Suspicious in code review (v2.1.14)

Our reviewer found behaviour consistent with malware in version 2.1.14, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.

381 indicators in this extension

381 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

Kortex NotebookLM: Gemini Notebook Toolkit, used by 100,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by other. Its permissions mean it can inject scripts into pages.

Key findings

  • High

    Other

    The published manifest summary on CWS only includes permissions ["contextMenus", "downloads"] and host_permissions ["*://[domain withheld]"]. However, the actual bundled manifest includes many more permissions (identity, storage, debugger, scripting, activeTab, unlimitedStorage, alarms) and broad host_permissions including "[domain withheld]" and "[domain withheld]", as well as many domain patterns. This discrepancy prevents users from accurately assessing the extension's access before installation and is a transparency violation.

Analyst notes

The extension's actual permissions (debugger, scripting, identity, storage, unlimitedStorage, activeTab, and broad host_permissions including all URLs) significantly exceed the permissions disclosed in the Chrome Web Store listing (only contextMenus and downloads). This mismatch is a transparency risk and may conceal dangerous capabilities from users. While the code appears legitimate and no data exfiltration to third parties was found, the undisclosed debugger and broad host permissions raise suspicion.

Kortex NotebookLM: Gemini Notebook Toolkit

Kortex NotebookLM: Gemini Notebook Toolkit Chrome extension security report

ID: hdapplggdhndkblofffknpmnnnnbncbn

Extension Info & Metadata

Status
Active
Version
2.3.6
Size
4.63 MB
Rating
4.4/5
Reviews
385
Users
100,000
Type
Extension
Updated
Oct 8, 2026
Category
Tools
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
1extension
All still listed

Publisher Contextual Analysis

Trusted
Author
kortex-notebooklm.com
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Users
100,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6
Screenshot 7
Screenshot 8
Screenshot 9

Install growth

Item
Type
Severity
Description
debugger
Permission
Critical
This permission grants the extension ability to debug and control other extensions and browser tabs. Rated Critical because it can access and modify other extensions' internal state, inject code, and access sensitive data from any tab.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
http://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
https://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
identity
Permission
High
This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: • 19% increase: Access to sensitive domains increases potential impact • 25% increase: Unsafe code evaluation capabilities increase attack surface
Unsafe WebAssembly Execution
Risk Factor
High
This extension's CSP allows "wasm-unsafe-eval".
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
https://chat.openai.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://chatgpt.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://claude.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.perplexity.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.linkedin.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://linkedin.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://reddit.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.reddit.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://x.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://twitter.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.grok.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.genspark.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://genspark.ai/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.genspark.im/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.kimi.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.googleusercontent.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.r2.cloudflarestorage.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://openevidence.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.openevidence.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.getmerlin.in/*
Host
Medium
Host permission — access limited to this URL pattern.
https://getmerlin.in/*
Host
Medium
Host permission — access limited to this URL pattern.
https://chat.getmerlin.in/*
Host
Medium
Host permission — access limited to this URL pattern.
https://gistr.so/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.gistr.so/*
Host
Medium
Host permission — access limited to this URL pattern.
https://app.gistr.so/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.youtube.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://youtube.com/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://www.linkedin.com/*, https://linkedin.com/*, https://twitter.com/*, https://*.google.com/*, https://*.googleusercontent.com/*
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
sidePanel
Permission
Low
This permission adds custom panels to the browser interface. Rated Low because it only affects browser UI elements and cannot access page content.

381 indicators in this extension

381 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

The All-in-One Toolkit for NotebookLM. Supercharge your research by capturing AI chats, Google Docs, and more.

Read the publisher’s full description

Your Power Toolkit for Google NotebookLM! Tired of your valuable intellectual work getting lost in different chats or locked inside research sources? Kortex is the browser extension that transforms Google's NotebookLM into a dynamic, interconnected knowledge base. It seamlessly bridges your AI conversations from ChatGPT, Gemini, and Claude, captures insights from any webpage, and adds powerful tools to manage and export your work. Kortex solves the problem of "trapped" intellectual work. Chat-based LLM interactions and web research are often difficult to search and cross-reference. Kortex breaks down these barriers, allowing you to build a unified, long-term, and truly usable knowledge base in NotebookLM. Key Features: 1) One-Click LLM Archiving: An integrated "NotebookLM" button in ChatGPT, Gemini, Claude, and Perplexity captures your full conversation and seamlessly imports it. 2) Highlight & Snipe: Highlight any text on a webpage, right-click, and send it directly to NotebookLM as a new, perfectly-cited source. 3) Google Docs Integration: Directly import your Google Docs as sources to integrate them with your other research materials. 4) Source Downloader: Easily export all the sources from a notebook into a single, convenient zip file in Markdown or plain text. This core functionality allows users to select multiple research sources from within a Google NotebookLM notebook and export them as a single .zip file containing Markdown (.md) or plain text (.txt) files. 5) Bulk Notebook Management: Select multiple notebooks on your dashboard to manage and delete them all at once. 6) Versatile Chat Export: Export your entire Q&A history from within NotebookLM into clean Markdown, plain text, or JSON files. 7) Curated Briefing Notes: Checkbox-select the most important AI responses in a chat to generate a concise, shareable briefing document with just the key insights. 8) Studio Notes Exporter: Select your notes from the studio and export them in your required format. Benefits You'll Experience: 🧠 Build a Unified Knowledge Base: Stop losing valuable AI interactions and web clippings. Integrate all your insights into one comprehensive and interconnected repository in NotebookLM. 🔍 Easily Search and Cross-Reference: Make your LLM conversations and web snippets fully searchable alongside all your other sources, unlocking their true value. 📤 Extract & Share Insights with Ease: Go from research to report in seconds. Effortlessly export full conversations or create curated summaries for colleagues, clients, or your own records. 🔒 Unlock Trapped Intellectual Work: Break free from the limitations of individual platform UIs and build a powerful, long-term resource from all your AI interactions and research.

User reviews

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs
136
IPv4
1

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

381 indicators in this extension

381 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
2.3.6
Latest
4.63 MBNot scanned—
89e8458c2ee10bcb1d3afb3099ce685037cf75f3d5fee6f2144ace97ee8f0427
2.3.5
4.63 MBNot scanned—
89e8458c2ee10bcb1d3afb3099ce685037cf75f3d5fee6f2144ace97ee8f0427
2.3.4
5.36 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
2.0.8
3.60 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
2.0.9
3.61 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
2.1.0
3.60 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
2.3.3
5.26 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
2.3.2
4.38 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
2.3.1
4.28 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
2.2.5
7.95 MBNot scanned—
48349534d0da2638bda1eeda06e213e0b369d87d5814864bed5af97272e55ab3
Showing 1 to 10 of 40 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Popular in Tools