Axhub is medium risk. The rating reflects signals from our analysis that have not yet been published as detailed findings.

Axhub is published by Axhub. The same operator publishes 1 other store listing, none of which carry a security finding.

Is Axhub safe?

Medium risk

Axhub accepts page-supplied URLs to fetch and execute remote JavaScript in any open tab via chrome.scripting.executeScript.

The extension's background service listens for internal messages containing a caller-supplied URL, fetches that URL's content with no domain validation, caches it in chrome.storage.local, and then injects the retrieved code into the MAIN world of any tab the user has open. Separately, a CustomEvent listener in the content script allows page-level JavaScript to overwrite the extension's WebSocket endpoint in storage, redirecting the Genie AI Editor connection to an arbitrary server on the next launch.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Axhubv2.5.13Chrome Web Store

40Risk

Who publishes it

Axhub - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Axhub

Same store account

1 other listing published from this account, 3k+ users between them, none of them carrying a finding.

Drafito3k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.