Is AI Chatbot safe?

Medium risk

Adds an AI assistant sidebar for writing, summarizing, translating, and brainstorming while browsing.

This extension provides a browser sidebar where users can paste text or links and ask an AI chatbot for help. The store description says it can summarize articles or documents, rewrite drafts, generate writing ideas, and translate or explain highlighted text in many languages.

v1.40Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Install-time country and device ID registration

When you install AI Chatbot, the extension generates a persistent device ID, looks up the device country through Cloudflare trace, and posts the ID, country, product name, and version to hub.malson.eu before you interact with the extension.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install the extension.

The extension did this

The extension creates a device ID, resolves your country, and sends both values to a remote server.

Fields involved in the install-time registration flow
  • Persistent device ID
    device_back_2eetoez878_1783831537783

    This lets later server records tie back to the same extension installation over time.

  • Country code
    GB

    This adds coarse location context to the registration record.

  • Network IP for lookup
    2.58.72.153

    The country lookup service sees the network address used by the browser during the request.

  • Product name
    deepseek_ai

    This tells the server which extension product the registration belongs to.

  • Extension version
    1.39

    This records which build of the extension created the registration.

Captured request
GEThttps://www.cloudflare.com/cdn-cgi/trace

Trace response observed during dynamic analysis included ip=2.58.72.153; the extension code reads the loc value as the country code.

Captured request
POSThttps://hub.malson.eu/api/users/update
Headers
Content-Type
application/json
Body
{  "user_id": "device_back_2eetoez878_1783831537783",  "product": "deepseek_ai",  "country": "GB",  "version": "1.39"}
The code that does this

The background worker creates the ID, looks up the country, and posts both values

Readable version

Readable background worker code

assets/js/background.js
function setInstallUrl() {    chrome.runtime.onInstalled.addListener(async (details) => {        if (details.reason === chrome.runtime.OnInstalledReason.INSTALL) {            const userId = await getUserId(true);                        let url = new URL(`https://aiagent.gallery/welcome_gpt.html`);                        // if( `deepseek_ai` === 'deepseek_ai' ){                // url = new URL(chrome.runtime.getURL('welcome.html'));            // }            chrome.tabs.create({ url: url.toString() });        }    });}function getUserId(generateIfMissing = true) {    return new Promise((resolve) => {        chrome.storage.sync.get(['user_id'], (result) => {            if (result.user_id) {                resolve(result.user_id);            } else if (generateIfMissing) {                createDeviceIdFromBackground().then(resolve);            } else {                resolve('none'); // or null / undefined            }        });    });}function createDeviceIdFromBackground() {    return new Promise(async (resolve) => {        const deviceId = `device_back_${Math.random().toString(36).substring(2, 12)}_${Date.now()}`;        chrome.storage.sync.set({ user_id: deviceId }, () => {            console.log("background.js->createDeviceIdFromBackground(): created and saved user_id:", deviceId);            resolve(deviceId);        });        try {            const country = await getCountry();            const response = await fetch("https://hub.malson.eu/api/users/update", {                method: "POST",                headers: {                    "Content-Type": "application/json"                },                body: JSON.stringify({                    user_id: deviceId,                    country: country,                    version: '1.39',                    product: 'deepseek_ai' || 'null'                })            });            if (!response.ok) {                console.warn("createDeviceIdFromBackground(): server error", await response.text());            } else {                console.log("createDeviceIdFromBackground(): user registered on server");            }        } catch (error) {            console.error("createDeviceIdFromBackground(): network error", error);        }    });}async function getCountry() {    try {        const res = await fetch('https://www.cloudflare.com/cdn-cgi/trace');        const text = await res.text();        const parsed = Object.fromEntries(            text.trim().split('\n').map(line => line.split('='))        );        console.log(`getCountry(): country is ${parsed.loc}`, parsed);        return parsed.loc;    } catch (err) {        console.error("getCountry(): error while fetching country", err);        return "null";    }}
Remote services contacted by this flow
    • www.cloudflare.com

    Receives the trace request used by the extension to derive the country code.

    • hub.malson.eu

    Receives the generated device ID, derived country, extension version, and product name.

Amplitude autocapture sends IDs and UI events

On startup, AI Chatbot initializes Amplitude analytics with autocapture enabled, sets its persistent device value as the Amplitude user ID, and sends events like page views and opening the welcome page to api2.amplitude.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or open the extension UI.

The extension did this

The extension starts Amplitude autocapture, assigns a persistent user ID, and records page and interaction events.

Observed and configured analytics fields
  • Amplitude project key
    b152cdc88ba063d10cb2a9d15e49ff9e

    This routes the analytics events to the extension operator's Amplitude project.

  • Amplitude user ID
    device_back_2eetoez878_1783831537783

    This links multiple analytics events to the same extension installation over time.

  • Amplitude device ID
    6bbd8321-4f92-48b3-9a48-2bd166f9cf1d (illustrative)

    This gives Amplitude another browser-level identifier for grouping analytics events.

  • Event names
    [Amplitude] Page Viewed; open welcome page

    These describe what extension view or button interaction happened.

  • Page context
    chrome-extension://npphdmcakmfhllhblkealgkeefamebih/welcome.html (illustrative)

    Autocaptured page-view events can include the extension page or tab context where the event happened.

Captured request
POSThttps://api2.amplitude.com/2/httpapi

Observed request body contained the Amplitude key prefix b152cdc88, user_id device_back_2eetoez878_1783831537783, device_id prefix 6bbd8321, and events '[Amplitude] Page Viewed' and 'open welcome page'.

The code that does this

The bundled page script initializes Amplitude and tracks named UI events

Readable version

Readable analytics module from the deobfuscated bundle

assets/js/b13f9dad87abe68abda6.js
class O {  async init() {    v.Ts("b152cdc88ba063d10cb2a9d15e49ff9e", {      autocapture: !0    });    const _ = new y.z;    await _.init();    const m = await y.z.getId();    v.do(m), this.initPlatformTracks(), this.initProductTracks()  }  initPlatformTracks() {    T("body").on("click", '[data-fancybox][data-src="#lang"]', (() => {      O.track("init language modal")    })), T("body").on("click", '[data-fancybox][data-src="#shareit"]', (() => {      O.track("init share modal")    })), T("body").on("click", '[data-fancybox][data-src="#feedback"]', (() => {      O.track("init feedback modal")    })), T("body").on("click", '[data-fancybox][data-src="#link"]', (() => {      O.track("init link modal")    })), T("body").on("click", ".js-rateImg", (() => {      O.track("click on rating")    })), T("body").on("click", ".js-pageOpenSettings", (() => {      O.track("open settings")    })), T("body").on("click", '[name="settings_theme"]', (() => {      O.track("change theme")    })), T("body").on("click", ".js-share", (() => {      O.track("click share")    })), T("body").on("click", ".js-copyLink", (() => {      O.track("click copy link")    })), T("body").on("click", ".js-filesShowDownloadedFile", (() => {      O.track("click show downloaded file")    })), T("body").on("click", ".js-fileDownload", (() => {      O.track("click download file again")    }))  }  initProductTracks() {    T("body").on("click", ".js-pageSideToggle", (() => {      O.track("open sidebar")    })), T("body").on("click", ".js-expand", (() => {      O.track("click expand")    })), T("body").on("click", ".js-chatNew", (() => {      O.track("click new chat")    })), T("body").on("click", ".js-pageToggleClick", (() => {      O.track("toggle sidebar settings")    })), T("body").on("click", ".js-shareWallClick", (() => {      O.track("click share wall")    })), T("body").on("click", ".js-chatCopy", (() => {      O.track("click copy response")    })), T("body").on("click", ".js-chatUp", (() => {      O.track("upvote chat")    })), T("body").on("click", ".js-chatDown", (() => {      O.track("downvote chat")    })), T("body").on("click", ".js-tipsWhatICanDo", (() => {      O.track("click start now")    })), T("body").on("click", ".js-adModalContent", (() => {      O.track("click market", {        campaign: "gpt5_popup"      })    })), location.href.includes("welcome.html") && (O.track("open welcome page"), O.track("open welcome page on service tab"))  }  static track(_, m) {    v.u4(_, m)  }}
Analytics destination
    • api2.amplitude.com

    Receives Amplitude analytics events, including page-view and named extension interaction events.

Updated 21 September 2026npphdmcakmfhllhblkealgkeefamebih