Is AI Math Solver & Calculator - Symbolab safe?

Medium risk

AI Math Solver & Calculator - Symbolab is medium risk. On a supported education or homework site, the content script sends a SeenFeature event to Amplitude. Dynamic analysis saw the full page URL, persistent user/device identifiers, and user agent, linking repeat visits from one profile.

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Supported page URLs are posted to Amplitude

On a supported education or homework site, the content script sends a SeenFeature event to Amplitude.

Dynamic analysis saw the full page URL, persistent user/device identifiers, and user agent, linking repeat visits from one profile.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a supported education or homework page.

The extension injects its content script on the URL patterns listed in its manifest.

The extension did this

The extension sends an analytics event that includes the page's full URL.

The event is sent automatically; no click on the extension UI is required.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api2.amplitude.com/2/httpapi
Dynamic analysis observed a POST whose JSON body contained event_type SeenFeature, event_properties.url set to https://en.wikipedia.org/wiki/Browser_extension, api_key fdd4e443a4ce53a2994ecd35ad59870f, a user_id beginning 0.bh3, a device_id beginning 4cdca495, and userAgent.
Headers
Accept*/*
Content-Typeapplication/json
03EvidenceFIELD TABLE
Fields carried by the SeenFeature event
FieldValueWhy it matters
Full page URL
https://en.wikipedia.org/wiki/Browser_extensionThis can reveal which lesson, document, article, or assignment page you viewed on a supported site.
Event name
SeenFeature / ExtensionIconThis labels the page load as a feature-view event tied to the extension icon.
Persistent user ID
0.bh3z9m4n1k2pThis lets repeated events from the same browser profile be grouped together over time.
Persistent device ID
4cdca495-8e0b-4f47-9aa1-3ab0a4c733e2This gives the analytics service another stable identifier for the same browser profile.
Browser user agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/126.0.0.0 Safari/537.36This adds browser and operating-system context to the page-view event.
Amplitude project key
fdd4e443a4ce53a2994ecd35ad59870fThis routes the event into the extension's Amplitude analytics project.
04EvidenceCODE COMPARE
The code that does this

The content script creates the event and the service worker posts it to Amplitude

What it actually does
Automatic SeenFeature event at content-script loadcontent/extension-ui.js
chrome.runtime.sendMessage({
    type: "track-event",
    eventName: "SeenFeature",
    eventProps: {
        "item": "ExtensionIcon",
        "url": window.location.href
    }
});
Service-worker bridge to the trackerjs/background.js
if (message.type === "track-event") {
    tracker.track(message.eventName, message.eventProps);
}
Tracker attaches identifiers and posts to Amplitudejs/tracker.js
async track(eventName, eventProps) {
    const userProps = {
        userAgent: navigator.userAgent,
    };

    chrome.storage.local
        .get(['userId', 'deviceId'])
        .then((result) => {
            if (!result?.userId) {
                result.userId = Math.random().toString(36).substring(0, 15);
                result.deviceId = generateUUID();
                chrome.storage.local.set({
                    userId: result.userId,
                    deviceId: result.deviceId,
                });
            }

            const events = [
                {
                    // Amplitude will complain if not both user_id and device_id are present:
                    user_id: result.userId,
                    device_id: result.deviceId,
                    event_type: eventName,
                    event_properties: eventProps,
                    user_properties: userProps,
                },
            ];

            fetch(AMPLITUDE_API_ENDPOINT, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    Accept: '*/*',
                },
                body: JSON.stringify({
                    // Note: the key is not secret:
                    api_key: AMPLITUDE_API_KEY,
                    events,
                }),
            })
                .then((response) => response.json())
                // .then(data => console.log(data))
                .catch((error) => {
                    console.error('Error:', error);
                });
        });
}
05EvidenceTHIRD PARTY LIST
External analytics destination
  • api2.amplitude.com

    Receives the SeenFeature analytics event containing the supported page URL, persistent identifiers, user agent, and event metadata.

Updated 17 September 2026mgfcnnpakbfcefgphceolkjldjfpieff