Is Glarity ChatGPT: Summary & Translate AnyPage safe?

Findings

{  "ext": {    "event_type": "Summary",    "log_type": "Data",    "llm_request_type": "Backend",    "current_url": "https://en.wikipedia.org/wiki/Machine_learning",    "execution_time": 3421  },  "browser_language": "en-US",  "browser_version": "124",  "device_id": "57815de789764c4d87e8685ba7c4c1f7",  "browser_type": "Chrome",  "os_type": "Windows",  "event_time": 1748800385123,  "timezone": "Europe/London",  "user_id": "usr_abc123",  "report_application_version": "4.46.4"}

function storeCurrentTabUrl(url) { const parsed = new URL(url); const originAndPath = parsed.origin + parsed.pathname; // strips query string + hash chrome.storage.local.set({ curUrl: originAndPath });}chrome.tabs.onActivated.addListener(async ({ tabId }) => { const tab = await chrome.tabs.get(tabId); if (tab.url) storeCurrentTabUrl(tab.url);});chrome.tabs.onUpdated.addListener((tabId, changeInfo) => { if (changeInfo.url) storeCurrentTabUrl(changeInfo.url);});

async function sendTelemetry(eventData, deviceId, skipStore) { const settings = await getSettings; const { curUrl } = await chrome.storage.local.get('curUrl'); const payload = { ext: eventData, browser_language: navigator.language, browser_version: userAgent.browser.major, device_id: deviceId, browser_type: userAgent.browser.name, os_type: userAgent.os.name, event_time: Date.now, timezone: Intl.DateTimeFormat.resolvedOptions.timeZone, user_id: userData?.data?.uid, report_application_version: chrome.runtime.getManifest.version, }; if (curUrl) payload.ext.current_url = curUrl; await fetch('https://log.felo.ai/api/data/report', { method: 'POST', body: JSON.stringify(payload), });}

What it can do

Permissions this extension asks for, as declared in version 4.46.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 4.46.7, which we have not unpacked yet.

• Read and change your data on every site you visit

  <all_urls>

• Read and change your data on openai.com

  https://*.openai.com/

• Read and change your data on openai.azure.com

  https://*.openai.azure.com/

• Read and change your data on glarity.app

  https://*.glarity.app/ and 2 more

• Read and change your data on google-analytics.com

  https://*.google-analytics.com/

• Read and change your data on xiaohongshu.com

  https://*.xiaohongshu.com/

• Read and change your data on api.glarity.app

  https://api.glarity.app/*

• Read and change your data on vi2vocal.s3.ap-northeast-1.amazonaws.com

  https://vi2vocal.s3.ap-northeast-1.amazonaws.com/*

• Read and change your data on www.google-analytics.com

  https://www.google-analytics.com/*

• Read and change your data on felo.ai

  https://*.felo.ai/*

• Read and change your data on felo.me

  https://*.felo.me/*

• Read and change your data on account.felo.ai

  https://account.felo.ai/*

• Read and change your data on glarityapi.com

  https://glarityapi.com/*

• Store data in your browser

  storage

• Act on the current tab, but only after you click the extension

  activeTab

• See the address and title of every tab you have open

  tabs

• Add items to the right-click menu

  contextMenus

• Show a panel beside the page

  sidePanel

• Run hidden pages in the background

  offscreen

• Read and change cookies, including the ones that keep you signed in

  cookies

• Run its own code inside the pages you visit

  scripting

Where it sends data

Destinations our analysis observed Glarity contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• Googlewidely used

  Glarity sends data to Google. Named as a recipient by 45 other extensions we have analysed.

• ChatGPT

  Glarity sends data to ChatGPT. Named as a recipient by 7 other extensions we have analysed.

• Microsoft

  Glarity sends data to Microsoft. Named as a recipient by 6 other extensions we have analysed.

• DeepL

  Glarity sends data to DeepL. Named as a recipient by 2 other extensions we have analysed.