Chrome Web Store
133Versions
1Code reviewed

Caution required

Suspicious in code review (v8.0.9)

Our reviewer found behaviour consistent with malware in version 8.0.9, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.

What our analysis found

Merlin - Ask AI to Research, Write & Review, used by 1,000,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (1 critical, 1 high), led by code injection. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests.

Key findings

  • critical· code injection —The script hardcodes a Google API key and implements a Proof of Origin Token (POT) minting mechanism to bypass YouTube's integrity checks. This can be used to make unauthorized requests to YouTube's internal APIs, facilitating data scraping or circumvention of security measures. The API key is directly embedded and exposed to the web page context.
  • high· other —The bundled manifest declares permissions (sidePanel, alarms, webNavigation, webRequest, scripting) that are not listed in the CWS published manifest summary, which only shows storage, tabs, contextMenus. This discrepancy could indicate a delayed update or a mismatch between the reviewed code and the live listing.

The extension includes code that circumvents YouTube's security measures by minting Proof of Origin Tokens, which is atypical for an AI assistant and could enable unauthorized access or data scraping. Additionally, the bundled manifest lists more permissions (sidePanel, alarms, webNavigation, webRequest, scripting) than the published CWS summary, indicating a potential mismatch.

Merlin - Ask AI to Research, Write & Review

Merlin - Ask AI to Research, Write & Review Chrome extension security report

ID: camppjleccjaphfdbohjdohecfnoikec

Supported Languages

🇪🇹Amharic
🇸🇦Arabic
🇧🇩Bengali
🇧🇷Brazilian Portuguese
🇬🇧British English
🇧🇬Bulgarian
🇪🇸Catalan
🇨🇳Chinese (Simplified)
🇹🇼Chinese (Traditional)
🇭🇷Croatian
🇨🇿Czech
🇩🇰Danish
🇳🇱Dutch
🇺🇸English
🇪🇪Estonian
🇵🇭Filipino
🇫🇮Finnish
🇫🇷French
🇩🇪German
🇬🇷Greek
🇮🇳Gujarati
🇮🇱Hebrew
🇮🇳Hindi
🇭🇺Hungarian
🇮🇩Indonesian
🇮🇹Italian
🇯🇵Japanese
🇮🇳Kannada
🇰🇷Korean
🇲🇽Latin American Spanish
🇱🇻Latvian
🇱🇹Lithuanian
🇲🇾Malay
🇮🇳Malayalam
🇮🇳Marathi
🇳🇴Norwegian
🇮🇷Persian
🇵🇱Polish
🇵🇹Portuguese
🇷🇴Romanian
🇷🇺Russian
🇷🇸Serbian
🇸🇰Slovak
🇸🇮Slovenian
🇪🇸Spanish
🇰🇪Swahili
🇸🇪Swedish
🇮🇳Tamil
🇮🇳Telugu
🇹🇭Thai
🇹🇷Turkish
🇺🇦Ukrainian
🇺🇸US English
🇻🇳Vietnamese

Extension Info & Metadata

Status
Active
Version
8.3.0
Size
4.17 MB
Rating
4.8/5
Reviews
8,791
Users
1,000,000
Type
Extension
Updated
Oct 5, 2026
Category
Tools
Price
Paid
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
2extensions
All still listed

Publisher Contextual Analysis

Trusted
Author
Foyer Tech
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Extensions
2
Active
2
Obsolete
0
Listed
2
Unlisted
0
Users
1,001,000

Screenshots & videos

Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6

Install growth

Item
Type
Severity
Description
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
https://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
<all_urls>
Risk Factor
Critical
This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Dangerous Permission Combination: scripting,<all_urls>,webRequest
Risk Factor
Critical
Enables sophisticated data theft through script injection and traffic monitoring
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 10% increase: Early script execution enables pre-emptive content manipulation
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://mail.google.com/*, https://www.linkedin.com/*, https://twitter.com/*
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
sidePanel
Permission
Low
This permission adds custom panels to the browser interface. Rated Low because it only affects browser UI elements and cannot access page content.
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Gain full insight into all external connections.

Upgrade for full visibility.

About this extension

26-in-1 Chrome extension to Research, Re-write, and Summarise content on any website

Read the publisher’s full description

🔥 Use Merlin AI to research and chat with websites, videos, and documents, plus write social media content in 128 languages 🔥 💪 Key Features: ✔️ Unified AI Models - Harness leading models for research, summarizing, translation, and content creation. ✔️ Real-Time Web & File Integration - Access live data, webpages, and documents without leaving Merlin. ✔️ Cross-Platform Convenience - Use one account across Chrome, Edge, iOS, Android, Windows, and Mac. ✔️ 70+ AI Tools - From AI Detector to AI , AI Humanizer, elevate your workflow in a snap. Boost your productivity and make your workflow truly magical! 🚀 🔰 Why Use us? Think of us as an AI chatbot that’s 20× more capable than typical models, we are powered by ChatGPT, Gemini, Anthropic Claude, Mistral, DeepSeek etc seamlessly integrating advanced features from multiple AI powerhouses. Far from competing, we supercharge your AI experience in some truly awesome ways. Here’s the scoop: 1️⃣ Ctrl+M/ Cmd+M: Instantly summon any AI model—GPT o1, 3.7 Sonnet, and more—right from any tab. No more juggling browsers; multitasking just got easier. 2️⃣ AI Playground: Get access to the platform powered by the big names—ChatGPT o1, o1-mini, GPT-4, 4o, 4o mini, Claude 3.7 Sonnet, and many more—all in one spot for richer insights. 3️⃣ Context is King: Whether you’re reading an article, replying to a tweet, or searching the web, Merlin acts as an in-context AI assistant powered by all the best of AI. 4️⃣ Save Prompts: Store and manage your favorite prompts, then deploy them anywhere online with ease. Store custom prompts for quick retrieval using “/” 5️⃣ Chat with Webpages: Open the extension as a sidebar on any website. Summarize, translate, extract key points, and more—right on the spot. 🔰 What Sets the Merlin Extension Apart? 1️⃣ Chat AI Capabilities in the Side Panel Multiple Models, One Interface: Seamlessly switch among GPT o1, GPT-4, GPT-4o, 3.7 Sonnet, 3.5 Haiku, and more—all in a single view. Take your AI chat sessions to the next level with an integrated approach, enabling you to chat with AI from multiple models seamlessly. Our chat AI environment merges them effortlessly, giving you a robust AI chatbot experience. 2️⃣ Projects Custom AI Chatbots: Transform your knowledge base, uploaded files, or links into dedicated AI assistants. Centralized Data: Keep everything in one searchable hub for easy access and organization. With Projects, you can also deploy an AI writer to generate content within these specialized assistants, ensuring your chat with AI remains highly productive. Each AI chatbot is fully customizable, letting you tailor responses to your unique workflow. 3️⃣ Crafts On-Demand Artifacts: Instantly generate code snippets, apps, or diagrams using any AI model—right from the chat. Live Preview: Watch your content come to life in a dedicated window beside the conversation. Advanced Data Analysis & Artifacts: Process data, create documents or websites, and edit or export them on the spot, like having your own AI agent. With Crafts, you can even integrate an AI image generator to produce visuals on the fly, perfectly complementing your AI writer for comprehensive content creation. 4️⃣ Chat with Files Images & Vision: Convert pictures to text or use text to generate images. PDFs & Docs: Use ChatPDF to summarize, translate, or OCR your documents for quick insights. Fast Overviews: Summarize websites, PDFs, or YouTube videos in seconds. Document Chat: Upload files and ask pinpoint questions—no need to sift through everything. Webpages: Interact directly with single or multiple site tabs—summarizing or extracting info on the fly. Easily incorporate your files into any AI chat session, ensuring you can chat with AI about documents or generate custom visuals via our AI image generator. 5️⃣ Reading Assistance Article Summaries: Quickly grab key points from any write-up. Video Summaries: Get YouTube highlights (with bilingual subtitles) so you can skip the full watch. Webpage & PDF Summaries: Instantly condense entire sites or PDFs into succinct overviews. 6️⃣ Writing Assistance Contextual Help Everywhere: Get real-time suggestions in any text box—tweets, LinkedIn posts, emails, and more. Paraphrasing & Outlining: Reword text for clarity and create structured outlines in seconds. Tone Tweaks & Sentence Sculpting: Adjust style and length to match your exact needs. Instant Content: Create essays, ad copy, or blog posts on demand—tailored to your style. 7️⃣ Translate Assistance Over 50 Languages (Up to 128 in Extended Features): Instantly translate text, compare different AI outputs, or even translate entire webpages. Image & Video Translation: Localize text on images and watch bilingual YouTube subtitles seamlessly. 8️⃣ Website Enhancements AI-Powered Search: Get concise, citation-linked answers on Google, Bing, Yahoo, etc. Gmail AI Assistant: Draft and refine emails without ever leaving your inbox. Community Q&A: Provide expert answers on Quora or StackOverflow using AI-driven insights. YouTube Summaries: Quickly see key takeaways from videos without watching them in full. 🚀 How to Get Started Install & Pin: Click “Add to Chrome” and pin it to your toolbar for easy access. Sign Up: Create your free account and unlock the full suite of features. Explore & Enjoy: Head to https://www.getmerlin.in/chat and start researching, summarizing, translating, and creating AI-driven content—right from your browser! 🔥 💌 Support & Feedback Any questions or suggestions? Please contact us at support@getmerlin.in For feedback, feature request & bug reports please check here https://feedback.getmerlin.in/ Merge the power of top-tier AI with your daily tasks! Research, write, translate, analyze, and create—all without leaving your Chrome tab. Download now and revolutionize the way you work! ✨

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs
136

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

Gain full insight into all external connections.

Upgrade for full visibility.

Version
Size
Verdict
Findings
Permhash
8.3.0
Latest
4.17 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.2.4
4.17 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.2.3
4.17 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.2.2
4.17 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.0.16
4.12 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.2.1
4.17 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.2.0
4.17 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.1.0
4.16 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
8.0.18
4.14 MBNot scanned—
b430275d9d6628fb061b21c24b6fbebba4aa1387f4a174579c889cc3f5824789
8.0.17
4.14 MBNot scanned—
79cac9d3473be10bc11944de9907502693aad2ffa0297608bc40c781f05648a2
Showing 1 to 10 of 140 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.