superReply is high risk. Clicking superReply in a Gmail reply window reads the quoted thread and forwards it to its hosted iframe at super-reply-dbaf0.web.app. No body was captured since the click wasn't triggered, but code passes the thread HTML to the bridge. Testing captured the extension fetching a version string from its Firebase host, then injecting an iframe from super-reply-dbaf0.web.app. AI reply and auth logic run there, outside CWS review; the developer can update behavior anytime.

Who makes superReply?

superReply is published by superReply, registered at 1540 Brockton Avenue, 203, Los Angeles, CA 90025, US. We hold no other store listing under the same registered identity.

Is AI Email Response Generator - superReply safe?

High risk

superReply is high risk. Clicking superReply in a Gmail reply window reads the quoted thread and forwards it to its hosted iframe at super-reply-dbaf0.web.app. No body was captured since the click wasn't triggered, but code passes the thread HTML to the bridge.…

superReplyv1.1.0.8Chrome Web Store

75Risk

Who publishes it

superReply - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

superReply

Declared legal entity

superReply

Registered address

1540 Brockton Avenue, 203, Los Angeles, CA 90025, US

Registered contact

shahar salem shmueli

Website

superreply.co/frequently-asked-questions/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Gmail reply threads forwarded to SuperReply web app

Clicking superReply in a Gmail reply window reads the quoted thread and forwards it to its hosted iframe at super-reply-dbaf0.web.app.

No body was captured since the click wasn't triggered, but code passes the thread HTML to the bridge.

Severity: High unwanted
Type: Unexpected
CWE: CWE-200
Source: Dynamic sandbox

What actually happens

You did this

You click the superReply button while replying in Gmail.

The extension adds this control to Gmail compose and thread-reply areas.

The extension did this

The extension reads the quoted Gmail thread and forwards it to the SuperReply iframe.

The value is packaged as Gmail message data before the popup iframe is shown.

Gmail fields read before the iframe handoff

Quoted Gmail thread
<div class="gmail_quote">On Tue, Jul 14, 2026 at 9:12 AM Alex Rivera <alex.rivera@example.com> wrote:<div>Can you send the contract notes?</div></div> (illustrative)
This can include earlier messages in the conversation you are replying to, not just the new text you type.
Sender display name
Jordan Lee (illustrative)
This ties the thread data to the Google account name visible in Gmail.
Message type marker
gmail_message_data
This tells the receiving iframe that the data came from a Gmail message flow.

Captured request

GEThttps://super-reply-dbaf0.web.app/1.1.0.8/iframe/

Hosted iframe document request; GET has no request body.

The code that does this

The shipped code reads Gmail thread HTML and hands it to the hosted iframe

Readable version

Show shipped source

Button handler packages the Gmail thread as waterfall_str

js/content.js

tick() {  let e = Array.from(document.querySelectorAll(this.selectors.compose_window));  this.activated_compose_window && !1 === e.includes(this.activated_compose_window) && (this.activated_compose_window = null, this.parent.popup_controller.hide()), e.forEach((e => {    if ("1" !== e.dataset.super_reply_extended) {      let t = this.get_waterfall_str(e);      if (t && "1" !== e.dataset.super_reply_extended) {        e.dataset.super_reply_extended = "1";        let r = e.querySelector(this.selectors.reply_buttons);        if (null === r.querySelector(this.selectors.super_reply_button)) {          let s = l.html_to_element(`                <div class = "super-reply-button" >                  ${m()}                </div>            `);          r.firstElementChild.after(s), s.addEventListener("click", (() => {            this.activated_compose_window = e, this.parent.popup_controller.toggle(e, s, {              type: "gmail_message_data",              version: "1.0.0",              waterfall_str: t,              sender: this.get_sender()            })          }))        }      }    }  })), Array.from(document.querySelectorAll(this.selectors.thread_page_reply_buttons)).forEach((e => {    if ("1" !== e.dataset.super_reply_extended) {      e.dataset.super_reply_extended = "1";      let t = l.html_to_element(`            <div class = "super-reply-button-big" >              ${p()}              <span>superReply</span>            </div>        `);      e.prepend(t), t.nextElementSibling instanceof HTMLElement && t.addEventListener("click", (() => {        let e = Array.from(document.querySelectorAll(this.selectors.compose_window)),          r = t.nextElementSibling;        r instanceof HTMLElement && r.click(), this.wait_for_new_compose_window_then_activate_it(e, 3e3)      }))    }  })), this.parent.storage.user_settings?.main_gmail_view_enabled && Array.from(document.querySelectorAll(this.selectors.msg_items)).forEach((e => {    e.querySelector(`.${this.selectors.super_reply.reply_btn}`) || this.paste_btn_in_msg_item(e)  }))}

Popup display forwards the prepared object to the Firebase iframe proxy

js/content.js

async show(e, t, r) {  let s = t.getBoundingClientRect(),    o = e.getBoundingClientRect(),    i = document.body.getBoundingClientRect(),    n = v.get_modal_position(600, 360, s, o, i);  this.modal_position = n, this.popup.style.display = "block", this.iframe.classList.add("super-reply-no-transitions"), this.button_left = s.left, this.button_top = s.top, this.iframe instanceof HTMLElement && (this.iframe.style.opacity = "0", this.iframe.style.width = "40px", this.iframe.style.height = "40px", this.iframe.style.top = `${s.top}px`, this.iframe.style.left = `${s.left}px`), await l.wait(10), this.iframe.classList.remove("super-reply-no-transitions"), await l.wait(10), this.iframe.style.opacity = "1", this.iframe.style.width = "600px", this.iframe.style.height = "360px", this.iframe.style.top = `${n.top}px`, this.iframe.style.left = `${n.left}px`, r && this.proxy_firebase_iframe.set_thread_data(r)}

Iframe helper creates the remote iframe URL

pages/iframe/iframe.js

inject_iframe(e, t) {  let r = document.createElement("iframe");  r.name = JSON.stringify({    parent: "extension"  }), r.setAttribute("allow", "camera; microphone; fullscreen; display-capture; clipboard-read; clipboard-write"), r.src = i.get_url(e, t), document.body.appendChild(r)}

Remote hosts named by the extension code and verification evidence

- super-reply-dbaf0.web.app
Firebase Hosting web app that serves the iframe receiving Gmail message data from the extension bridge.
- us-central1-super-reply-dbaf0.cloudfunctions.net
Firebase Cloud Functions backend configured for the SuperReply project.
- plankton-app-65l3o.ondigitalocean.app
DigitalOcean-hosted API root named in the extension configuration and verification indicators.

Extension UI loads from remote Firebase app, bypassing Chrome Web Store review

Testing captured the extension fetching a version string from its Firebase host, then injecting an iframe from super-reply-dbaf0.web.app.

AI reply and auth logic run there, outside CWS review; the developer can update behavior anytime.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-829
Source: Dynamic sandbox

What actually happens

You did this

You open the extension popup or visit Gmail or Outlook with superReply installed.

This happens automatically on each mail page load.

The extension did this

The extension fetches the current UI version from a remote Firebase server and injects an iframe whose source points to that server.

All AI reply generation, user authentication, and data handling run from the remotely-served JavaScript, which can be updated without a CWS review.

Captured request

GEThttps://super-reply-dbaf0.web.app/v/1.1.0.8.txt?ts=1776478151212

HTTP 200, 9 bytes. Body: '1.1.0.8.2'. Extension stores this value as version_frontend in chrome.storage.local and uses it to construct the iframe URL.

The code that does this

Remote version fetch and iframe injection

Readable version

Show shipped source

// pages/popup/popup.js:947-948 (identical in pages/iframe/iframe.js:947-948)async fetch_version_frontend() {  return await fetch(    s.urls.firebase_hosting_root + '/v/' + c + '.txt?ts=' + Date.now()  ).then((e => e.text()))   .catch((e => (console.log('error', e), null)))  || c  // falls back to installed version on fetch failure}// inject_iframe uses the returned version_frontend:inject_iframe(e, t) {  let r = document.createElement('iframe');  r.name = JSON.stringify({ parent: 'extension' });  r.setAttribute('allow', 'camera; microphone; fullscreen; display-capture; clipboard-read; clipboard-write');  r.src = i.get_url(e, t);  // resolves to https://super-reply-dbaf0.web.app/{version_frontend}/iframe/  document.body.appendChild(r);}

Remote hosting origin for extension UI

- super-reply-dbaf0.web.app
Developer-controlled Firebase Hosting. Serves the versioned iframe bundle with all AI reply, auth, and data-handling logic. Content can be updated without a CWS review cycle.
- us-central1-super-reply-dbaf0.cloudfunctions.net
Firebase Cloud Functions backend. Receives API calls from the remote iframe for AI reply generation and account management.

What it can do

Permissions this extension asks for, as declared in version 1.1.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

Read and change your data on mail.google.com
https://mail.google.com/*
Read and change your data on outlook.office365.com
https://outlook.office365.com/*
Read and change your data on outlook.live.com
https://outlook.live.com/*
Read and change your data on outlook.office.com
https://outlook.office.com/*
Store data in your browser
storage