Is GMB Crush - GBP Audits for Quick Local SEO Insights safe?

Medium risk

GMB Crush is medium risk. Choosing a prompt in the popup fetches templates from extadmin.gmbcrush.com/api/prompts and can submit that server text into ChatGPT. The server can update the template before it is sent from the ChatGPT page.

gmbcrushv40.0.1.18Chrome Web Store
45Risk
Who publishes it

SEO Heroes Bangkok Co.,Ltd - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
gmbcrush
Declared legal entity
SEO Heroes Bangkok Co.,Ltd
Registered address
Loft Lane LaSalle, Soi La Salle 54-56,, Bangkok, Bangkok 10260, TH
Registered contact
SEO Heroes Bangkok Co.,Ltd
Website
www.gmbcrush.com/customer-support/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote server controls ChatGPT prompt templates submitted by the extension

Choosing a prompt in the popup fetches templates from extadmin.gmbcrush.com/api/prompts and can submit that server text into ChatGPT.

The server can update the template before it is sent from the ChatGPT page.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The user opens the extension popup, chooses a prompt, and submits the prompt form.

The extension did this

The extension fetches prompt templates from extadmin.gmbcrush.com and injects the selected server-provided text into ChatGPT for submission.

Captured request
GETextadmin.gmbcrush.com/api/prompts
Fields in the request
  • Page URL
    https://example.com/business-profile (illustrative)

    URL context can reveal which page or workflow the prompt request relates to.

What it can do

Permissions this extension asks for, as declared in version 40.0.1.18. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on www.google.com

    *://www.google.com/*

  • Read and change your data on chat.openai.com

    https://chat.openai.com/chat/*

  • Read and change your data on chatgpt.com

    https://chatgpt.com/*

  • Keep running in the background while your browser is open

    background

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026aakkhbloifflgelkkikmbakldbhllbfj