Is ChatGPT Extension safe?
ChatGPT Extension uploads user-selected image attachments to ImageBB before sending them to ChatGPT.
When a user attaches an image, the extension reads the file in the popup and posts the base64 image data to ImageBB using an embedded API key. The returned ImageBB URL is then included as the image URL in the chat message sent for ChatGPT processing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Selected vision images upload to ImageBB before ChatGPT processing
When you choose an image attachment for ChatGPT, the extension converts that selected file to base64 and uploads it to ImageBB first.
The ImageBB URL is then stored as the attachment URL and included in the later chat message payload.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You select an image attachment for ChatGPT.
The extension converts the selected image to base64 and uploads it to ImageBB before using the returned URL in the chat message payload.
- Selected image attachmentselected-image.jpg (illustrative)
The image you chose is converted to base64 and sent as the upload form input.
What it can do
Permissions this extension asks for, as declared in version 1.1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Store an unlimited amount of data in your browser
unlimitedStorage
Show a panel beside the page
sidePanel
Sign you in with your Google account
identity
Where it sends data
Destinations our analysis observed ChatGPT Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.imgbb.com
ChatGPT Extension sends data to api.imgbb.com. 6 other extensions we have analysed send data here.