Is ChatsNow: ChatGPT AI Sidebar (o1-preview, GPT-4o, Claude 3, Gemini) safe?
ChatsNow: ChatGPT AI Sidebar (o1-preview, GPT-4o, Claude 3, Gemini) is high risk. On install and update, ChatsNow sends a persistent per-install ID and the URL of your active browser tab to a third-party Aliyun logging endpoint, before you interact with the extension or agree to anything.…
Who publishes itkevin - 1 other listing from the same operator, none carrying a finding
kevin - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 2k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
ChatsNow beacons your active tab's URL and a persistent ID to Aliyun
On install and update, ChatsNow sends a persistent per-install ID and the URL of your active browser tab to a third-party Aliyun logging endpoint, before you interact with the extension or agree to anything.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install ChatsNow, receive an update, or open extension UI actions such as settings.
No dialog discloses this beacon or asks for consent first.
The background service worker sends your active tab's URL and a persistent install ID to Aliyun's logging service.
The same function fires again on every UI action the extension tags as 'sendAli'.
{ "__logs__": [ { "extension_name": "ai-assistant", "version": "1.5.5", "user_ip": "", "uuid": "8f2b19e2-4c31-4e77-9c0e-51b7f6a2d9be (illustrative)", "install_time": "1732104812 (illustrative)", "event_time": "1732104812 (illustrative)", "event_category": "install", "event_operate": "user_install", "event_tag": "1.5.5", "browser_type": "chrome", "operate_system": "Win7", "region": "", "email": "", "language": "en-US", "domain": "undefined", "payStatus": "free" } ]}- Your active tab's web addresshttps://mail.google.com/mail/u/0/ (illustrative; populated from your active tab)
Ties your browsing to a specific extension install, before you've used the extension.
- Persistent install ID8f2b19e2-4c31-4e77-9c0e-51b7f6a2d9be (illustrative)
A unique ID created once per install so Aliyun can link every beacon back to the same install over time.
- Your account emailsent only when signed in
If you're signed into ChatsNow, your email is attached to the same beacon.
- Subscription statusfree
Whether you're on the free or paid tier.
- hawkeye-us.us-west-1.log.aliyuncs.com
Alibaba Cloud (Aliyun) log-analytics endpoint used by the vendor for install/usage telemetry; not named in the Chrome Web Store listing or a visible privacy notice.
What it can do
Permissions this extension asks for, as declared in version 1.5.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Add items to the right-click menu
contextMenus
Read and change cookies, including the ones that keep you signed in
cookies
Run its own code inside the pages you visit
scripting
Show a panel beside the page
sidePanel