Is AI Math Solver & Calculator - Symbolab safe?
AI Math Solver & Calculator - Symbolab is medium risk. On a supported education or homework site, the content script sends a SeenFeature event to Amplitude. Dynamic analysis saw the full page URL, persistent user/device identifiers, and user agent, linking repeat visits from one profile.
Who publishes itCOURSE HERO SYMBOLAB LTD - no other listings under this identity, 1 shared hostname
COURSE HERO SYMBOLAB LTD - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Supported page URLs are posted to Amplitude
On a supported education or homework site, the content script sends a SeenFeature event to Amplitude.
Dynamic analysis saw the full page URL, persistent user/device identifiers, and user agent, linking repeat visits from one profile.
What actually happens
You open a supported education or homework page.
The extension injects its content script on the URL patterns listed in its manifest.
The extension sends an analytics event that includes the page's full URL.
The event is sent automatically; no click on the extension UI is required.
Captured request
Dynamic analysis observed a POST whose JSON body contained event_type SeenFeature, event_properties.url set to https://en.wikipedia.org/wiki/Browser_extension, api_key fdd4e443a4ce53a2994ecd35ad59870f, a user_id beginning 0.bh3, a device_id beginning 4cdca495, and userAgent.
- Accept
- */*
- Content-Type
- application/json
Fields carried by the SeenFeature event
- Full page URLhttps://en.wikipedia.org/wiki/Browser_extension
This can reveal which lesson, document, article, or assignment page you viewed on a supported site.
- Event nameSeenFeature / ExtensionIcon
This labels the page load as a feature-view event tied to the extension icon.
- Persistent user ID0.bh3z9m4n1k2p
This lets repeated events from the same browser profile be grouped together over time.
- Persistent device ID4cdca495-8e0b-4f47-9aa1-3ab0a4c733e2
This gives the analytics service another stable identifier for the same browser profile.
- Browser user agentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/126.0.0.0 Safari/537.36
This adds browser and operating-system context to the page-view event.
- Amplitude project keyfdd4e443a4ce53a2994ecd35ad59870f
This routes the event into the extension's Amplitude analytics project.
The code that does this
The content script creates the event and the service worker posts it to Amplitude
Automatic SeenFeature event at content-script load
content/extension-ui.jschrome.runtime.sendMessage({ type: "track-event", eventName: "SeenFeature", eventProps: { "item": "ExtensionIcon", "url": window.location.href }});Service-worker bridge to the tracker
js/background.jsif (message.type === "track-event") { tracker.track(message.eventName, message.eventProps);}Tracker attaches identifiers and posts to Amplitude
js/tracker.jsasync track(eventName, eventProps) { const userProps = { userAgent: navigator.userAgent, }; chrome.storage.local .get(['userId', 'deviceId']) .then((result) => { if (!result?.userId) { result.userId = Math.random().toString(36).substring(0, 15); result.deviceId = generateUUID(); chrome.storage.local.set({ userId: result.userId, deviceId: result.deviceId, }); } const events = [ { // Amplitude will complain if not both user_id and device_id are present: user_id: result.userId, device_id: result.deviceId, event_type: eventName, event_properties: eventProps, user_properties: userProps, }, ]; fetch(AMPLITUDE_API_ENDPOINT, { method: 'POST', headers: { 'Content-Type': 'application/json', Accept: '*/*', }, body: JSON.stringify({ // Note: the key is not secret: api_key: AMPLITUDE_API_KEY, events, }), }) .then((response) => response.json()) // .then(data => console.log(data)) .catch((error) => { console.error('Error:', error); }); });}External analytics destination
- api2.amplitude.com
Receives the SeenFeature analytics event containing the supported page URL, persistent identifiers, user agent, and event metadata.
What it can do
Permissions this extension asks for, as declared in version 2.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/* and 1 more
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Add items to the right-click menu
contextMenus
Show a panel beside the page
sidePanel