Is Export Gemini Chats to PDF: Download & Archive Gemini Chats safe?
Export Gemini Chats to PDF accepts unchecked postMessage on gemini.google.com, letting any page trigger a silent, attacker-chosen download.
When exporting a chat as a PDF or image, the extension opens a hidden iframe on gemini.google.com and listens for a postMessage reply, but it never checks who sent that message. The background script then hands the message's dataUrl straight to chrome.downloads.download, and only values starting with "data:" are treated as the generated file — anything else, including an attacker-supplied URL, is fetched and saved to disk without a prompt. A page that opens a handle to the user's Gemini tab (for example via window.open) can exploit this to force a silent download while an export is in progress.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itNeo Cortex LLC - 21 other listings from the same operator, none carrying a finding
Neo Cortex LLC - 21 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
21 other listings published from this account, 18k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.