Curateit is high risk. CurateIt sends the full URL of every site you visit to its server automatically, on page load and each tab switch, with no action from you. Labelled 'fetch-bookmarks', it runs on every navigation, logging your browsing while signed in. When you click the Curateit icon on AI chat sites, the extension reads the prompt text and sends it to Curateit's memory API. The request includes form input and DOM content from ChatGPT, Claude, Gemini, or Perplexity. 1 further issue was flagged.

Curateit is published by Savan V.

Is Curateit safe?

High risk

Curateit is high risk. CurateIt sends the full URL of every site you visit to its server automatically, on page load and each tab switch, with no action from you. Labelled 'fetch-bookmarks', it runs on every navigation, logging your browsing while signed in.…

Savan V.v8.4.1Chrome Web Store

78Risk

Who publishes it

Savan V. - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Savan V.

Website

curateit.com

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

link.com

Also called by 3 other listings, including TextingHouse

africau.edu

Also called by 5 other listings, including Reader Mode, PDF Reader and Editor, AverPoint

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every Page Visit Reported to CurateIt Server in Real Time

CurateIt sends the full URL of every site you visit to its server automatically, on page load and each tab switch, with no action from you.

Labelled 'fetch-bookmarks', it runs on every navigation, logging your browsing while signed in.

Severity: High unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

You load any webpage while signed in to CurateIt.

No bookmark action is required, the transmission happens on every navigation automatically.

The extension did this

The extension sends a GET request containing the full URL to api.curateit.com.

The request includes your authenticated Bearer token, linking the URL to your CurateIt account.

Captured request

GEThttps://api.curateit.com/api/fetch-bookmarks?url=https://www.amazon.com/dp/B0CWVKK8NF

JSON response indicating whether the URL is saved and whether it is a blocked site. dynamic analysis captured 6 such requests across google.com (rows 47, 347) and amazon.com (row 442).

Headers

Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDI3ODksImlhdCI6MTcxNTAxMTIwMCwiZXhwIjoxNzQ2NTQ3MjAwfQ.xZ8b2mNv9KoLpQ3_rTjwYhDUsFnExAMPLETOKEN

The code that does this

The function that fires on every page load

Readable version

Show shipped source

async function checkURL { const data = await checkUserLogin; const url = window.location.href; if (data?.userData?.token || data?.userData?.userData?.token) { loggedIn = true; fetch(`${data.userData.apiUrl}/api/fetch-bookmarks?url=${url}`, { method: "GET", headers: { "Content-Type": "application/json", Authorization: `Bearer ${ data.userData.token || data?.userData?.userData?.token }`, }, }) }

The code that does this

Two separate callers ensure the request fires on every navigation and tab switch

Readable version

Show shipped source

IIFE at top of side-panel.js (document_end)

scripts/side-panel.js:1-4

(async function { await checkURL;});

Message handler for FETCH_URL_AGAIN in side-panel.js

scripts/side-panel.js:3523-3526

if (typeof msg === "object" && msg.type === "FETCH_URL_AGAIN") { chrome.storage.sync.remove("gemId"); checkURL;}

Data transmitted in each request

Visited URL
https://mail.google.com/mail/u/0/#inbox/FMfcgzQXJvPzNkRbWvTlHhqKmLBsVdpw
The full address of the page you're viewing, including path and query, which may hold search terms, document IDs, or session tokens.
Authentication token
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDI3ODl9.xZ8b2mNv
Your signed-in session credential, sent with every request, which ties the URL report to your account identity.

Destination receiving your browsing history

- api.curateit.com
CurateIt's own backend API. Receives every visited URL paired with the user's Bearer token, building a server-side record of the user's complete browsing history.

AI chat prompt text sent to Curateit memory API on icon click

When you click the Curateit icon on AI chat sites, the extension reads the prompt text and sends it to Curateit's memory API.

The request includes form input and DOM content from ChatGPT, Claude, Gemini, or Perplexity.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-200
Source: Dynamic sandbox

What actually happens

You did this

The user clicks the Curateit icon inside a supported AI chat page.

The extension did this

The extension reads the current chat prompt text and sends it to Curateit's memory API to retrieve relevant memories.

Captured request

GEThttps://api.curateit.com/api/memories

Fields in the request

Page DOM content
ChatGPT prompt editor content (illustrative)
Identifies content available in the AI chat page where the Curateit button is used.
AI chat prompt text
Summarize these notes for my meeting (illustrative)
Contains the text the user has typed into the AI chat prompt field before sending it.

Inline AI prompt sends typed webpage input to Curateit API

When you type an inline AI command like /ai or ai: into a webpage field, Curateit sends the prompt text to api.curateit.com.

The request can include form input and page context; the AI response is placed back into the field.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-200
Source: Dynamic sandbox

What actually happens

You did this

The user types an inline AI command in a webpage input field.

The extension did this

Curateit extracts the prompt text and posts it to its AI response API.

Captured request

POSTapi.curateit.com/api/send-ai-response

Fields in the request

Your typed prompt
ai: summarize this paragraph; (illustrative)
Text entered into a webpage form can include private details the user intended to process with the inline AI feature.
Page content context
Selected article text from the current page (illustrative)
Page text or DOM context can reveal what site or content the user is working with when invoking the AI feature.

+1 more finding not shown

Get started Scan your browser

What it can do

Permissions this extension asks for, as declared in version 8.4.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

Read and change your data on every site you visit
<all_urls> and 1 more
Read and change your data on twitter.com
https://twitter.com/* and 2 more
Read and change your data on x.com
https://x.com/* and 2 more
Read and change your data on mobile.twitter.com
https://mobile.twitter.com/*
Read and change your data on development-api.curateit.com
https://development-api.curateit.com/*
Read and change your data on api.curateit.com
https://api.curateit.com/*
Read and change your data on api.twitter.com
https://api.twitter.com/*
Read and change your data on www.linkedin.com
https://www.linkedin.com/*
Read and change your data on medium.com
https://medium.com/* and 1 more
Read and change your data on www.reddit.com
https://www.reddit.com/*
Read and change your data on github.com
https://github.com/*
Read and change your data on dev-app.curateit.com
https://dev-app.curateit.com/
Read and change your data on curateit.com
https://curateit.com/
Read and change your data on localhost:3000
http://localhost:3000/
Read and change your data on www.youtube.com
https://www.youtube.com/*
Read and change your data on play.google.com
https://play.google.com/*
Read and change your data on every secure site you visit
https://*/*
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
See the address and title of every tab you have open
tabs
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Add items to the right-click menu
contextMenus
Read and change your full browsing history
history
Run searches with your default search engine
search
Clear your browsing history, cache and cookies
browsingData
Read and change cookies, including the ones that keep you signed in
cookies
Read and change your bookmarks
bookmarks
Read and change your tab groups
tabGroups