Summarizer

Summarizer

ID: majmehefocdbcngkghicollbnbbakcbl

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status
Active
Version
3.0
Size
0.01 MB
Rating
0.0/5
Reviews
0
Users
4
Type
Extension
Updated
Feb 19, 2024
Category
Tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
23amitvyasView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
3
Active
2
Obsolete
1
Listed
3
Unlisted
0
Total Users
15
Screenshot 1
Screenshot 2

Gives AI generated Summaries

This extension uses eden ai api to get ai generated summaries from open ai api.

This extension requests no permissions and has no recorded risk factors.

User-entered text is POSTed to a personal PythonAnywhere account (`vyasamit23.pythonanywhere.com`) that does not match the publisher identity ('23amitvyas') or the declared backend (Eden AI / OpenAI). This constitutes routing potentially sensitive user text to an unverified third-party server. No data-collection category covering 'text typed by user' is disclosed in the CWS listing, so this is not covered by disclosure.

popup.js (Line 10)
const apiUrl = 'https://vyasamit23.pythonanywhere.com/summary/';const requestOptions = {  method: 'POST',  body: JSON.stringify({    "text": selectedText.value  }),  headers: {    'Content-Type': 'application/json'  }};fetch(apiUrl, requestOptions)

All text the user enters in the popup textarea is unconditionally POSTed to a personal pythonanywhere.com backend (vyasamit23.pythonanywhere.com). This endpoint is not disclosed in the CWS data-collection declaration (none declared) and is not a well-known SaaS. The server operator can log every string submitted, including potentially sensitive content pasted by the user. The listing describes use of 'eden ai api' and 'openai api', but the actual destination is a personal Python server, not those services.

popup.js (Line 10)
const apiUrl = 'https://vyasamit23.pythonanywhere.com/summary/';const requestOptions = {  method: 'POST',  body: JSON.stringify({    "text": selectedText.value  }),  headers: {    'Content-Type': 'application/json'  }};fetch(apiUrl, requestOptions)

By severity

Critical0
High1
Medium1
Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
3.02

Files with findings

1 distinct path — top paths by unique finding count:

  • popup.js2
S.No.
Category
Severity
File
Summary
Found in Version
1Data Exfiltration
high
popup.js (line 10)User-entered text is POSTed to a personal PythonAnywhere account (`vyasamit23.pythonanywhere.com`) that does not match the publisher identity ('23amitvyas') or the declared backend (Eden AI / OpenAI). This constitutes…
2Unauthorized Data Collection
medium
popup.js (line 10)All text the user enters in the popup textarea is unconditionally POSTed to a personal pythonanywhere.com backend (vyasamit23.pythonanywhere.com). This endpoint is not disclosed in the CWS data-collection declaration …
URLs
2
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
vyasamit23.pythonanywhere.com/summary/https://vyasamit23.pythonanywhere.com/summary/

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Version
Size
Is Malicious
Findings
Permhash
3.0
Latest
0.01 MB
Malicious
2N/A
Showing 1 to 1 of 10 rows
Rows per page:

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.