Is Эй, Бро! - Твой Chat GPT помощник safe?

Medium risk

Эй Бро ChatGPT helper transmits all chat conversations, including attached screenshots, to its own backend server at ai-backend.heybro.ai.

Every query a user sends through the extension — including the text prompt, conversation history, selected AI model, and any attached images — is forwarded to ai-backend.heybro.ai via Socket.IO. Full chat histories are also uploaded to the same server, with each message stored alongside its timestamp and any attached files. A background polling loop runs every 60 seconds, sending a persistent account-level user ID to the server as long as the user is logged in.

Эй, Бро!v4.0.2Chrome Web Store
48Risk
Who publishes it

Эй, Бро! - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Эй, Бро!
Website
heybro.ai/contacts

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

HeyBro AI polls its backend with your account ID every 60 seconds

The service worker sends a GET to ai-backend.heybro.ai every 60 seconds while logged in, each with your account ID, letting the backend correlate session timing with your account.

Fires unconditionally on a timer, not user-triggered.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
When this fires

Every 1 minute

While you are logged in, the extension's service worker polls ai-backend.heybro.ai with your account user ID once every 60 seconds.

Captured request
GEThttps://ai-backend.heybro.ai/get_info?userId=<planted-marker>&sourceType=ext&initial=1

Returns JSON with model availability and token balance data. Three requests observed during dynamic analysis in a ~180 second session, each carrying the planted account ID verbatim.

Headers
Accept
application/json
Query parameters sent on every poll
  • Account user ID
    usr_4f8a2c1e9b3d

    Your persistent account ID assigned at login, tying every poll to your account across sessions.

  • Source type
    ext

    Hard-coded as 'ext', indicating the request originated from the browser extension rather than the web app.

  • Initial flag
    1

    Hard-coded as '1' on every poll, present in all observed requests regardless of session state.

The code that does this

setInterval in background.iife.js:2826-2854 that drives the polling

Readable version
setInterval(async () => {  const loggedInStatus = await loadLoggedIn();  if (!loggedInStatus) {    return;  }  const userId = await loadUserId();  if (!userId) {    return;  }  const params = new URL(`${APP_BASE_URL}/get_info`);  params.searchParams.append("userId", userId);  params.searchParams.append("sourceType", "ext");  params.searchParams.append("initial", "1");  const response = await fetch(params.toString(), {    method: "GET",    headers: {      Accept: "application/json"    }  });  const info = await response.json();  if (info.message) {    console.log("invalid request", info.message);    return;  }  if (info.models) {    saveCachedModels(info.models);  }  chrome.runtime.sendMessage({ action: "update_tokens", payload: info });}, 60 * 1e3);
Destination receiving account-ID polls
    • ai-backend.heybro.ai

    HeyBro AI's own backend API. Receives the persistent account user ID on every 60-second poll. Returns model availability and token balance data.

What it can do

Permissions this extension asks for, as declared in version 4.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Write to your clipboard

    clipboardWrite

  • Run its own code inside the pages you visit

    scripting

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Show a panel beside the page

    sidePanel

Where it sends data

Destinations our analysis observed Эй, Бро! contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ai-backend.heybro.ai

    Эй, Бро! sends data to ai-backend.heybro.ai. No other extension we have analysed sends data here.

  • o731358.ingest.us.sentry.io

    Эй, Бро! sends data to o731358.ingest.us.sentry.io. No other extension we have analysed sends data here.

Updated 30 September 2026ffoidoiaecmiamaljkhfhjacemefalec