Is GPT-BOSS safe?

Low risk

GPT-BOSS lets any embedding page ask its panel to fetch an image URL and upload it to vkboss-light.super-smm.com.

The extension exposes panel.html to all sites and its message listener accepts gptboss:intent messages from the parent frame without checking the sender origin. For image intents, it fetches the supplied image URL, turns the response into a file, and uploads it through the extension API client to vkboss-light.super-smm.com.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

VK-Bossv2.0.2Chrome Web Store
15Risk
Who publishes it

Super-SMM - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
VK-Boss
Declared legal entity
Super-SMM
Registered address
Торжокская 16, Санкт-Петербург 194223, Россия
Registered contact
Константин

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed GPT-BOSS contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • vkboss-light.super-smm.com

    GPT-BOSS sends data to vkboss-light.super-smm.com. No other extension we have analysed sends data here.

Updated 30 September 2026pcjammoipmckejbpkojnekedndmbglbk