Is Kimi 浏览器助手 safe?

Medium risk

Kimi is medium risk. Kimi AI sends the URL and title of every page visited to gator.volces.com, a ByteDance endpoint, via its bundled Ranger SDK, linking events to your account. 10 POSTs captured visiting Wikipedia, Amazon, Reddit.

Kimiv1.1.3Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

ByteDance Analytics SDK Sends Every URL You Visit to gator.volces.com

Kimi AI sends the URL and title of every page visited to gator.volces.com, a ByteDance endpoint, via its bundled Ranger SDK, linking events to your account. 10 POSTs captured visiting Wikipedia, Amazon, Reddit.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

You navigate to any website in Chrome.

No interaction with Kimi is required, simply loading a page is enough.

The extension did this

The extension's content script automatically posts the page URL, page title, and your Kimi account ID to gator.volces.com.

ByteDance's Ranger SDK fires a predefine_pageview event to https://gator.volces.com/list with no user prompt.

Captured request

POSThttps://gator.volces.com/list

HTTP 200 OK. Observed 10 CS-originated POST requests to gator.volces.com/list across a session navigating to wikipedia.org, amazon.com, and reddit.com.

Headers

Content-Type: application/json

Body

[  {    "events": [      {        "event": "predefine_pageview",        "params": {          "title": "Wikipedia, the free encyclopedia",          "url": "https://www.wikipedia.org/",          "url_path": "/",          "time": 1748200441823,          "referrer": "",          "$is_first_time": "false"        },        "local_time_ms": 1748200441823      }    ],    "user": {      "user_unique_id": "7647976293220235270",      "web_id": "7647976293220235270",      "user_is_login": true    },    "header": {      "app_id": 20001731,      "channel": "cn",      "platform": "web-extension",      "app_version": "1.1.3"    }  }]

Fields transmitted in every predefine_pageview event

Page URL
https://www.amazon.com/s?k=laptop+bags&ref=nb_sb_noss
The full address of the page you are currently visiting, including path, query parameters, and fragment.
Page title
Amazon.com: laptop bags
The title of the page as shown in your browser tab.
Kimi account ID
7647976293220235270
A numeric identifier tied to your signed-in Kimi account. Links every browsing event to your identity across sessions.
Web ID
7647975992572578315
A persistent device-level identifier assigned by ByteDance's SDK. Persists across sessions even without a Kimi account.
Referrer URL
https://www.google.com/search?q=best+laptops
The URL of the page you navigated from, revealing your navigation path.

The code that does this

SDK initialisation in content-scripts/content.js

Readable version

Show shipped source

SDK initialisation and startup

content-scripts/content.js

var rangerInstance = new RangerSDK("default");rangerInstance.init({  app_id: 20001731,  channel_domain: "https://gator.volces.com"});rangerInstance.start();rangerInstance.config({  platform: AppInfo.platform,   // "web-extension"  app_version: AppInfo.version  // "1.1.3"});

Account ID binding

content-scripts/content.js

async function initTracking() {  if (await tokenStore.getToken()) {    const user = await kimiAuth.getUser();    rangerInstance.config({      user_unique_id: user?.id  // numeric Kimi account ID    });  }}

Automatic page-view event payload

content-scripts/content.js

function sendPageView(overrides = {}) {  const payload = {    title: document.title || location.pathname,    url: location.href,    url_path: location.pathname,    time: Date.now(),    referrer: document.referrer,    $is_first_time: String(this.configManager?.is_first_time ?? false)  };  this.sendEvent("predefine_pageview", { ...payload, ...overrides });}

ByteDance-operated endpoints receiving browsing telemetry

- gator.volces.com
Primary ingest endpoint for ByteDance's Ranger SDK. Receives predefine_pageview events with page URL, title, account ID, and web ID on every navigation.

Relationship to Kimi/Moonshot AI

This extension is published by Moonshot AI. The analytics endpoint (gator.volces.com) is operated by ByteDance — a separate company — via its Volcano Engine cloud platform. The same SDK and app_id (20001731) appear in both content-scripts/content.js and chunks/collect-Y551xQiu.js. The Kimi Chrome Web Store listing does not disclose data sharing with ByteDance infrastructure.

What it can do

Permissions this extension asks for, as declared in version 1.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Show a panel beside the page
sidePanel