Is NotebookLM Source Helper safe?

NotebookLM Source Helper answers flashcard requests from embedded scf.usercontent.goog frames without origin checks.

NotebookLM Source Helper injects into scf.usercontent.goog frames and listens for flashcard extraction messages. When a frame receives an ANKI_GET_FLASHCARDS message, it reads flashcard-related DOM content and sends the extracted cards back to the parent window without validating the sender origin.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.