Is QuestionAI Homework Powered AI Assistant safe?

High risk

QuestionAI is high risk. QuestionAI writes a persistent cookie, QUESTION_AI_PCUID, into five sites (google.com, baidu.com, facebook.com, youtube.com, instagram.com), same value each. Expires in ~100 years, not HttpOnly. Lands automatically, no visit needed.…

D3 Dimension Technologyv2.8.26Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassMALICIOUS
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Tracking Cookie Written to Google, Facebook, YouTube, Baidu, Instagram

QuestionAI writes a persistent cookie, QUESTION_AI_PCUID, into five sites (google.com, baidu.com, facebook.com, youtube.com, instagram.com), same value each.

Expires in ~100 years, not HttpOnly.

Lands automatically, no visit needed.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install QuestionAI and use it once, so it can generate a client ID for itself.

The extension did this

QuestionAI writes that ID as a cookie named QUESTION_AI_PCUID directly into the cookie jars of google.com, baidu.com, facebook.com, youtube.com, and instagram.com.

It also reads the cookie back from any of those five sites and re-writes it to all of them, keeping the same value synced across every site's cookie jar -- you never have to visit any of these sites yourself.

02EvidenceSTORAGE DUMP
What's stored on your device

The same tracking ID was found on all five sites named here, confirming it was planted broadly, not scoped to the extension's own domain.

Locationchrome.cookies store, cookie name QUESTION_AI_PCUID
Contents (JSON)
{
  "www.baidu.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
  "www.google.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
  "www.youtube.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
  "www.facebook.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
  "www.instagram.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761"
}
03EvidenceCODE COMPARE
The code that does this

The code that writes the persistent ID onto five third-party sites' cookie jars.

What it actually does
The tracked-site list and the fan-out write function
const TRACKED_SITES = [
  "https://www.questionai.com",
  "https://passport.questionai.com",
  "https://www.google.com",
  "https://www.baidu.com",
  "https://www.facebook.com",
  "https://www.youtube.com",
  "https://www.instagram.com",
];
const PCUID_COOKIE_NAME = "QUESTION_AI_PCUID";

// Called whenever the persistent client ID is generated or refreshed
async function persistIdEverywhere(cookieName, value) {
  await setLocalStorage(cookieName, value);
  for (const siteUrl of TRACKED_SITES) {
    await writeCookieOnSite(cookieName, value, siteUrl);
  }
}
The underlying chrome.cookies.set call
// Writes a cookie directly into the named site's cookie jar via the
// privileged chrome.cookies API -- not marked HttpOnly, expires ~100 years out
function writeCookieOnSite(name, value, url) {
  return new Promise((resolve) => {
    chrome.cookies.set({
      url,
      name,
      value,
      expirationDate: Date.now() / 1000 + 3153600000, // ~100 years
    }, resolve);
  });
}
The ID-resolution flow that keeps the cookie synced across all five sites
// Resolves (or mints) the persistent client ID, then fans it out to
// every tracked site's cookie jar -- including reading it back from
// whichever site already has it, if any
async function getPersistentClientId() {
  let pcuid = await getLocalStorage(PCUID_COOKIE_NAME);
  if (!pcuid) pcuid = await readCookieFromAnyTrackedSite(PCUID_COOKIE_NAME);
  if (pcuid) {
    persistIdEverywhere(PCUID_COOKIE_NAME, pcuid); // re-syncs it to all sites
    return pcuid;
  }
  const { data } = await api.fetchPost(APIKeys.GET_PCUID, { uuid: await getOrCreateUuid(), cuid: "start" });
  persistIdEverywhere(PCUID_COOKIE_NAME, data.cuid);
  return data.cuid;
}
04EvidenceTHIRD PARTY LIST
Sites this cookie is planted on, whether or not you've ever used QuestionAI there:
  • www.google.com

    Receives the QUESTION_AI_PCUID cookie; readable by any script running on google.com pages since the cookie is not HttpOnly.

  • www.baidu.com

    Receives the QUESTION_AI_PCUID cookie; readable by any script running on baidu.com pages since the cookie is not HttpOnly.

  • www.facebook.com

    Receives the QUESTION_AI_PCUID cookie; readable by any script running on facebook.com pages since the cookie is not HttpOnly.

  • www.youtube.com

    Receives the QUESTION_AI_PCUID cookie; readable by any script running on youtube.com pages since the cookie is not HttpOnly.

  • www.instagram.com

    Receives the QUESTION_AI_PCUID cookie; readable by any script running on instagram.com pages since the cookie is not HttpOnly.

05EvidenceARTIFACT
Check if you're affected

Checks whether the QUESTION_AI_PCUID tracking cookie is present on the current site. Since the cookie is not HttpOnly, it is readable from any page's own script context via document.cookie.

RequiresChrome with QuestionAI extension installed and enabledA visit to one of the five listed sitesDeveloper Tools access (F12)
questionai-pcuid-cookie-check.js · js
// questionai-pcuid-cookie-check.js
// Run in the DevTools console on google.com, baidu.com, facebook.com,
// youtube.com, or instagram.com while QuestionAI is installed.
(function () {
  const match = document.cookie.split('; ').find((row) => row.startsWith('QUESTION_AI_PCUID='));
  if (match) {
    console.log('[QAI_PCUID] Tracking cookie found on this site:');
    console.log('  ' + match);
    console.log('  This cookie was written by the QuestionAI extension, not by this site.');
  } else {
    console.log('[QAI_PCUID] No QUESTION_AI_PCUID cookie found on this domain right now.');
  }
})();
How to run it
  1. 1
    Install QuestionAI, let it fully load.
  2. 2
    Open google.com, baidu.com, facebook.com, youtube.com, or instagram.com.
  3. 3
    Press F12, open Console.
  4. 4
    Paste this script, press Enter.
  5. 5
    If present, the cookie prints.
SeverityMEDIUM
ClassMALICIOUS
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Full List of Installed Extensions Sent to studyquicks.com

Every QuestionAI sidebar load asks for the installed-extension list (chrome.management.getAll) and sends it, names, IDs, versions, states, to autotrack.studyquicks.com.

Captured firing twice in one session, no consent prompt or opt-out.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the QuestionAI sidebar on any page.

The extension did this

QuestionAI asks the browser for the full list of installed extensions, then sends it (names, IDs, versions, states) to a third-party analytics domain.

This runs on every sidebar mount, is not limited to QuestionAI's own listing, and has no visible opt-out.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://autotrack.studyquicks.com/log/math_h5
Captured twice in the same session, identical payload (retried delivery by the analytics client). The test environment had only this one extension installed, so the array has a single entry -- on a normal browser it would contain every installed extension.
Body
name=H60_112&ets=%5B%7B%22name%22%3A%22QuestionAI+Homework+Powered+AI+Assistant%22%2C%22enabled%22%3Atrue%2C%22version%22%3A%222.8.26%22%2C%22id%22%3A%22hajphibbdloomfdkeoejchiikjggnaif%22%7D%5D&isDark=0
03EvidenceFIELD TABLE
One object like this is sent per extension you have installed:
FieldValueWhy it matters
Extension name
QuestionAI Homework Powered AI AssistantThe human-readable name of each extension installed in your browser, sent for every one of them.
Extension ID
hajphibbdloomfdkeoejchiikjggnaifThe Store ID of each installed extension, letting the analytics service profile your browser's exact extension toolset.
Extension version
2.8.26The installed version number of each extension.
Enabled state
trueWhether each extension is currently turned on or off in your browser.
04EvidenceCODE COMPARE
The code that does this

The code that retrieves and transmits your full extension inventory.

What it actually does
Sidebar mount handler -- requests and forwards the full extension list
// sidebar.js -- runs when the sidebar content script mounts
sendToBackground({ messageType: "getExtensionsInfo" }, (allExtensions) => {
  if (Array.isArray(allExtensions) && allExtensions.length) {
    const inventory = allExtensions.map((ext) => ({
      name: ext?.name,
      enabled: ext?.enabled,
      version: ext?.version,
      id: ext?.id,
    }));
    addZSEvent("H60_112", {
      ets: JSON.stringify(inventory), // full extension inventory, unfiltered
      isDark: prefersDarkMode ? 1 : 0,
    });
  }
});
Background handler -- answers with the browser's full extension/app inventory
// background.js -- service worker message handler
case "getExtensionsInfo":
  chrome.management.getAll((allExtensions) => {
    sendResponse(allExtensions); // every installed/enabled extension and app, not just this one
  });
  return true;
05EvidenceTHIRD PARTY LIST
Where your extension inventory ends up:
  • autotrack.studyquicks.com

    Analytics beacon endpoint (bundled third-party client, zpID 'OB-MATH-PCW') that receives the full list of your browser's installed extensions on every QuestionAI sidebar mount.

06EvidenceARTIFACT
Check if you're affected

Hooks fetch() and XMLHttpRequest to detect and print the extension-inventory beacon QuestionAI sends to autotrack.studyquicks.com, decoding the ets field so you can see exactly which of your extensions were included.

RequiresChrome with QuestionAI extension installed and enabledAt least one other extension installed to see the list is not QuestionAI-onlyDeveloper Tools access (F12)
questionai-extlist-monitor.js · js
// questionai-extlist-monitor.js
// Run in the DevTools console on any page with QuestionAI active.
(function () {
  function inspect(label, url, body) {
    if (!url || !url.includes('log/math_h5')) return;
    console.log('[QAI_EXTLIST] ' + label + ' intercepted:', url);
    const params = new URLSearchParams(body || '');
    const ets = params.get('ets');
    if (ets) {
      try {
        console.log('  extensions reported:', JSON.parse(decodeURIComponent(ets)));
      } catch (e) {
        console.log('  raw ets value:', ets);
      }
    }
  }

  const origFetch = window.fetch;
  window.fetch = function (input, init) {
    const url = typeof input === 'string' ? input : input instanceof Request ? input.url : String(input);
    inspect('fetch', url, init && init.body);
    return origFetch.apply(this, arguments);
  };

  const origSend = XMLHttpRequest.prototype.send;
  const origOpen = XMLHttpRequest.prototype.open;
  XMLHttpRequest.prototype.open = function (method, url) {
    this._qaiUrl = url;
    return origOpen.apply(this, arguments);
  };
  XMLHttpRequest.prototype.send = function (body) {
    inspect('XHR', this._qaiUrl, body);
    return origSend.apply(this, arguments);
  };

  console.log('[QAI_EXTLIST_MONITOR] installed. Open or reopen the QuestionAI sidebar to trigger the beacon.');
})();
How to run it
  1. 1
    Install QuestionAI with one other extension.
  2. 2
    Open a page, press F
  3. 3
    1
  4. 4
  5. 5
    Console tab, paste this script, press Enter.
  6. 6
    Open (or reopen) the sidebar.
  7. 7
    Watch for a [QAI_EXTLIST] entry showing your list sent.
Updated 10 September 2026hajphibbdloomfdkeoejchiikjggnaif