Is ChatGPT to Google Docs, Word or PDF safe?
ChatGPT to Google Docs, Word or PDF is medium risk. On install, the extension reads your signed-in Chrome account email and sends it, plus a generated device ID, to two Thinksolv-owned servers before you use any feature. We observed this happen during dynamic analysis of a fresh install.
Who publishes itThinksolv technologies (OPC) private limited - 5 other listings from the same operator, 1 of them carrying a finding
Thinksolv technologies (OPC) private limited - 5 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 157k+ users between them. 1 of them carries a finding.
Same operator - 1 listing
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
ChatGPT to Google Docs sends your Google account email to Thinksolv on install
On install, the extension reads your signed-in Chrome account email and sends it, plus a generated device ID, to two Thinksolv-owned servers before you use any feature.
We observed this happen during dynamic analysis of a fresh install.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install the extension from the Chrome Web Store.
No sign-up screen or consent prompt is shown first.
The background service worker reads your Chrome account email and sends it to Thinksolv's servers.
This happens on the first service worker startup, before you use any conversion feature.
- Your Google account emaillennyyeeman@gmail.com
The email tied to your signed-in Chrome profile, read without asking.
- Generated device ID784c5ca800486b28f3152e9a4e390633
A tracking ID created by a third-party endpoint the first time the extension runs.
- Email-list identifierstemplateId: 12, listId: 9
Values that map to a specific list and template in an email marketing system.
- Sender addressvikram@thinksolv.com
The Thinksolv address the resulting marketing email would come from.
Sent with mode: no-cors, so the extension itself never reads a response. We observed this exact request leave the device twice during a single fresh install.
- Content-Type
- application/json
{ "email": "lennyyeeman@gmail.com", "name": "", "templateId": 12, "listId": 9, "fromEmail": "vikram@thinksolv.com", "sendEmail": true}Server responded success:true both times we observed this request during a fresh install.
- Content-Type
- application/json
{ "eventName": "user_signed_up", "eventData": { "userEmail": "lennyyeeman@gmail.com", "cfUserId": "784c5ca800486b28f3152e9a4e390633", "browser": "chrome", "hostApp": "chatgpt-to-gdocs-pdf-ext" }, "LAPPNAME": "B"}The install handler that collects and sends your email
chrome.runtime.onInstalled.addListener((details) => { if (details.reason === chrome.runtime.OnInstalledReason.INSTALL) { try { chrome.tabs.create({ url: installUrl }); // opens the welcome page } catch (err) { // tab creation can fail if the user is mid-drag; ignored } (async () => { // 1. Read the signed-in Chrome account email let email = await getProfileEmail(); if (!email) email = "email_na@thinksolv.com"; // 2. Fetch a per-install tracking ID from a Cloudflare Worker let cfUserId = 0; try { cfUserId = await fetchCfUserId(); } catch (e) { cfUserId = 0; } // 3. Cache both values locally saveLocalProperties({ email, cfUserId }); // 4. Log an install/signup analytics event carrying the email + tracking ID logEvent("user_signed_up", { userEmail: email, cfUserId, browser: detectBrowser(), }); // 5. POST the email straight to Thinksolv's mailing-list API await fetch("https://userapi.thinksolv.com/", { method: "POST", headers: { "Content-Type": "application/json" }, mode: "no-cors", body: JSON.stringify({ email, name: "", listId: 9, templateId: 12, fromEmail: "vikram@thinksolv.com", sendEmail: true, }), }); })(); }});function getProfileEmail() { return new Promise((resolve) => { if (detectBrowser() !== "chrome") return resolve(`${detectBrowser()}_email@thinksolv.com`); chrome.identity.getProfileUserInfo({ accountStatus: "ANY" }, (info) => { if (chrome.runtime.lastError || !info.email) resolve("email_na@thinksolv.com"); else resolve(info.email); }); });}async function fetchCfUserId() { const res = await fetch("https://cf-userid-generator.aruchamyvikram.workers.dev/", { method: "GET", headers: { "Content-Type": "application/json" }, }); if (!res.ok) throw new Error(`HTTP ${res.status}`); return res.text(); // a generated per-install tracking ID}function logEvent(eventName, eventData) { eventData.hostApp ||= "chatgpt-to-gdocs-pdf-ext"; return fetch("https://chatph.thinksolv.com", { method: "POST", headers: { "Content-Type": "application/json" }, mode: "no-cors", body: JSON.stringify({ eventName, eventData, LAPPNAME: "B" }), });}- userapi.thinksolv.com
Receives your email plus email-marketing metadata (templateId, listId, fromEmail) on every fresh install.
- chatph.thinksolv.com
Receives an analytics event containing your email and the generated tracking ID.
- cf-userid-generator.aruchamyvikram.workers.dev
A Cloudflare Worker, run under the same developer's account, that issues the per-install tracking ID.