Is Hide Google AI-Overviews safe?

Medium risk

Hide Google AI Overviews is medium risk. Hide Google AI-Overviews only hides Overviews locally when a token, enabled flag, and user ID exist in sync storage. It validates the token with appvector.io, sending credential and storage data for a check gating a cosmetic page change.

Appvectorv1.7Chrome Web Store
45Risk
Who publishes it

Appvector - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Appvector
Website
appvector.io/#contact-us

Same store account

1 other listing published from this account, 3k+ users between them, none of them carrying a finding.

Keyword Planner: Get Volume, CPC, SEO Keyword Trends3k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AI Overview hiding depends on AppVector token validation.

Hide Google AI-Overviews only hides Overviews locally when a token, enabled flag, and user ID exist in sync storage.

It validates the token with appvector.io, sending credential and storage data for a check gating a cosmetic page change.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The user takes the action required to enable the AI Overview hider.

The extension did this

The extension checks stored token, enabled-state, and user ID values, then validates the token with AppVector before applying the local hiding logic.

Captured request
GETappvector.io/aso-tool/api/v1/auth-token/
Fields involved in the validation request
  • Your account token
    Token <redacted>

    The token is a credential used to authorize the extension's AppVector validation request.

  • Extension sync storage values
    extensionEnabled=true, userId=12345 (illustrative)

    Stored values such as the enabled flag and user ID determine whether the local hiding feature runs.

Observation

Observed during dynamic analysis: the hiding logic was gated on stored token, enabled-state, and user ID values, and the background script validated the token against AppVector.

What it can do

Permissions this extension asks for, as declared in version 1.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on appvector.io

    https://appvector.io/*

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Updated 30 September 2026inhojdjgfnnpphfknlfbejchnjjnkpfl