Is Chegg CourseHero Bartleby Skip Question safe?

Medium risk

Chegg CourseHero Bartleby Skip Question is medium risk. Using the injected Like flow on Chegg's my-answers page posts Chegg answer IDs and question bodies to unblur.top. The flow fetches your Chegg answer list with credentials, encodes the question body, and submits it with the answer ID.

Alcazarv3.8.13Chrome Web Store
45Risk
Who publishes it

Alcazar - no other listings under this identity, 4 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Alcazar
Website
t.me/chegg_edit

Shared hosts - 4 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

bartleby.com
Also called by 1 other listing: ZapStudy Unlocker
coursehero.com
Also called by 3 other listings: ZapStudy Unlocker, Course Hero: AI Study Assistant, Filo - Instant Ask button
cdn.walkme.com
Also called by 5 other listings
gateway.chegg.com
Also called by 5 other listings, including EasyBib Toolbar, Your starting point: a smart to-do list, built for you., Cite This For Me

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Chegg answer IDs and question bodies are posted to unblur.top

Using the injected Like flow on Chegg's my-answers page posts Chegg answer IDs and question bodies to unblur.top.

The flow fetches your Chegg answer list with credentials, encodes the question body, and submits it with the answer ID.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user clicks the injected Like control on a Chegg my-answers page.

The extension did this

The extension collects the Chegg answer ID and encoded question body, then posts them to unblur.top.

Captured request
POSThttps://unblur.top/upvotes/confirm
Fields in the request
  • Chegg question body
    What is Newton's second law? (illustrative)

    The text of a Chegg question associated with the user's answer list is sent with the request.

What it can do

Permissions this extension asks for, as declared in version 3.8.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on cdn.walkme.com

    *://cdn.walkme.com/*

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026ehnebalpnnjcobeiiccagcdakcpjbgma