Is ChatGPT File Uploader safe?
ChatGPT File Uploader is medium risk. ChatGPT File Uploader fetches a URL from customergen.pythonanywhere.com every popup open, then opens a new tab at whatever address the server returns. The popup also embeds an iframe from that host. Neither is disclosed in the listing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension opens server-controlled URLs from undisclosed third-party host
ChatGPT File Uploader fetches a URL from customergen.pythonanywhere.com every popup open, then opens a new tab at whatever address the server returns.
The popup also embeds an iframe from that host.
Neither is disclosed in the listing.
You open the extension popup.
Clicking the extension icon loads popup.html, which runs popup.js.
The extension contacts customergen.pythonanywhere.com and opens the URL it receives in a new tab.
Two GET requests to /get_embedded_url were captured in dynamic analysis. The response URL is passed directly to chrome.tabs.create without validation.
| Origin | chrome-extension://oaogphgfdbdbmhkiplemgehihiiececj |
Server-controlled tab-open logic in popup.js
// popup.js lines 6-26 function openYouTubeVideo() { fetch( "https://CustomerGen.pythonanywhere.com/get_embedded_url?_=" + new Date().getTime() ) .then((response) => response.text()) .then((youtubeVideoUrl) => { // Remove quotation marks from the URL youtubeVideoUrl = youtubeVideoUrl.replace(/['"]+/g, ""); // Update the stored URL chrome.storage.local.set({ embeddedUrl: youtubeVideoUrl }); // Open a new tab with the YouTube video URL chrome.tabs.create({ url: youtubeVideoUrl }); }) .catch((error) => { console.error("Error:", error); }); }Iframe embedding third-party content in popup.html
<!-- popup.html lines 49-55 --> <iframe src="https://CustomerGen.pythonanywhere.com" width="560" height="315" frameborder="0" allowfullscreen ></iframe>
- customergen.pythonanywhere.com
Flask app on PythonAnywhere (shared Python hosting). Serves the URL opened in a new tab and is also loaded as an iframe in the popup. Not disclosed in the store listing.
What it can do
Permissions this extension asks for, as declared in version 1.2.5.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on chatgpt.com
*://chatgpt.com/*
Show you desktop notifications
notifications
Store data in your browser
storage