Is Send Mass Mail + HTML inserter for Gmail safe?

High risk

Send Mass Mail + HTML inserter for Gmail sends visible page text to gpt.ga when its AI assistant generates answers.

The extension installs an AI assistant content script on all websites and includes page context by default when generating an answer. That page context is built from visible text in the page body, then sent through the background script to gpt.ga's AIAssistant.getAnswers API.

KMC solutionsv2.2.3Chrome Web Store
73Risk
Who publishes it

Semalt LLC - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
KMC solutions
Declared legal entity
Semalt LLC
Registered address
400 Harbour Pl Dr, Tampa, FL 33602-6717, US
Registered contact
Iurii Iakovenko
Website
mailbrother.com/support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Page Text Sent to gpt.ga for AI Answers

With page context on, generating an AI assistant answer makes the extension read visible page text and include it in a request to gpt.ga.

It runs on all websites, so this can include content from non-Gmail pages where the panel is used.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You generate an assistant answer with page context enabled.

The page-context setting defaults to enabled in the assistant component.

The extension did this

The extension reads visible text from the current page and sends it to gpt.ga with the answer request.

The code adds the text after a Page context marker before sending the GET_ANSWERS message to the background service worker.

Fields assembled for the assistant request
  • Page context marker
    Page context:

    This separates the webpage text from the rest of your assistant prompt.

  • Visible page text
    Quarterly roadmap: launch timeline, account notes, and visible project comments (illustrative)

    This can reveal the content of the page you are reading when you ask the assistant to use page context.

  • Assistant prompt
    Summarize this page for a follow-up email

    Your selected or typed prompt is sent alongside the page text so the remote answer can be generated.

  • Request envelope
    argsJson contains mode, promptID or prompt, and data

    The page context and prompt are wrapped into the assistant API request sent from the extension.

Captured request
POSThttps://gpt.ga/api/call/AIAssistant.getAnswers
The code that does this

The source path from page text to the gpt.ga POST

Readable version

Generate action with page context enabled by default

assistant.js
includePageContext: true,async generateAnswer() {  const request = { mode: this.mode, promptID: 0, prompt: "", data: [] };  if (this.mode === "select") {    request.promptID = this.promptID;  } else {    request.prompt = this.customPrompt;  }  if (this.includePageContext) {    request.data.push("Page context:");    request.data.push(this.getPageContext());  }  request.data.push("Additional context:");  request.data.push(...this.context);  return this.sendMessage({ type: "GET_ANSWERS", data: request });}

Page-text collector used by the Generate action

assistant.js
getPageContext() {  return this.getPageText(document.body).trim();}getPageText(node) {  const blockedTags = new Set([    "SCRIPT",    "STYLE",    "NOSCRIPT",    "TEMPLATE",    "IFRAME",    "HEAD",    "META",    "LINK"  ]);  if (node.nodeType === Node.ELEMENT_NODE && node.id === "ai-assistant-extension") {    return "";  }  if (node.nodeType === Node.ELEMENT_NODE && blockedTags.has(node.tagName)) {    return "";  }  if (node.nodeType === Node.TEXT_NODE) {    return node.textContent || "";  }  let pageText = "";  for (const child of Array.from(node.childNodes)) {    pageText += this.getPageText(child);  }  return pageText;}

Background API wrapper posting to gpt.ga

background.js
constructor() {  this.domainAPI = "https://gpt.ga";  this.jwt = "";}async getAnswers(params) {  return this.post("AIAssistant.getAnswers", params);}async post(method, ...args) {  const body = new FormData();  const url = `${this.domainAPI}/api/call/${method}`;  body.append("argsJson", JSON.stringify(args));  const headers = new Headers();  headers.set("Authorization", `Bearer ${this.jwt}`);  headers.set("X-Chrome-Extension-Domain", chrome.runtime.getURL(""));  const response = await fetch(url, {    method: "POST",    credentials: "include",    headers,    body  });  const data = await response.json();  if (data.err) {    throw new Error(data.err);  }  if (data.meta) {    this.setJWT(data.meta.jwt);  }  return data.res;}
Remote service receiving the assistant request
    • gpt.ga

    Receives the AIAssistant.getAnswers POST containing the assistant prompt and the page-context data assembled by the extension.

What it can do

Permissions this extension asks for, as declared in version 2.2.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Send Mass Mail + HTML inserter for Gmail contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • gpt.ga

    Send Mass Mail + HTML inserter for Gmail sends data to gpt.ga. No other extension we have analysed sends data here.

Updated 30 September 2026obngoldljmnnpggbekneikaohbeflbee