Is Web Scraper Pro safe?

Medium risk

Web Scraper Pro sends your Chrome profile email and scraped page URLs and titles to chatph.thinksolv.com.

On install, the extension reads the signed-in Chrome profile email and posts it to chatph.thinksolv.com. The same email is attached to later analytics events, such as listing or exporting extracted data, together with the URL, title and domain of the page being scraped. No consent prompt is shown before this happens.

Strong link to a flagged operator: 1 of the 5 other listings from the same operator is rated high or critical for malicious behaviour. Flagged: Convert ChatGPT to Google Doc (high).

stackvidhyav1.0.0Chrome Web Store
49Risk
Who publishes it

Thinksolv Technologies OPC Private Limited - 5 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
stackvidhya
Declared legal entity
Thinksolv Technologies OPC Private Limited
Website
www.thinksolv.com/contact

Same operator - 5 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

ChatGPT to Google Docs, Word or PDF
same declared legal entity
9k+Medium
ChatGPT to Word or PDF
same declared legal entity
100k+Medium
Convert ChatGPT to Google Doc
same declared legal entity
20k+High
Claude to PDF, Word and Google Docs
same declared legal entity
7k+Medium
Gemini to Google Docs
same declared legal entity
40k+Medium

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

chatph.thinksolv.com
Also called by 6 other listings, including Shopify Spy Pro - Shopify Scraper
static.zara.net
Also called by 6 other listings, including Katalon Recorder
thinksolv.com
Also called by 6 other listings, including Shopify Spy Pro - Shopify Scraper

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Web scraper sends your Chrome profile email to chatph.thinksolv.com

Code analysis shows the signed-in Chrome profile email is attached to analytics events POSTed to chatph.thinksolv.com on install and on later events, which also carry page URLs.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You install the extension while signed in to Chrome.

The extension did this

It reads your profile email and POSTs it to chatph.thinksolv.com.

Later analytics events repeat the email.

The code that does this

Email lookup and event payload assembly

Readable version

Profile email lookup, falls back to email_na@thinksolv.com

background.js
function X() {  return new Promise(t => {    if (U() !== "chrome" || typeof chrome?.identity?.getProfileUserInfo != "function") {      t(he);      return    }    chrome.identity.getProfileUserInfo({      accountStatus: "ANY"    }, r => {      chrome.runtime?.lastError || !r?.email ? t(he) : t(r.email)    })  })}

Common payload merged into every event

background.js
async function Ke() {  const [t, e] = await Promise.all([X(), Y()]);  return {    hostApp: k.hostApp ?? C.hostApp,    userEmail: t,    cfUserId: e,    browser: U(),    extension_version: Ge()  }}

Event sender

background.js
static async track(e, r = {}) {  const o = k.endpoint ?? C.ingestUrl;  let a = {    ...await Ke(),    ...r  };  const d = typeof a.url == "string" && a.url.trim() || typeof a.dataset_url == "string" && a.dataset_url.trim() || typeof a.tab_url == "string" && a.tab_url.trim() || "";  d && (a.page_url = d, a.source_page_url = d, (typeof a.url != "string" || !a.url.trim()) && (a.url = d));  for (const p of L) a = {    ...await p(e, a)  };  const l = {    eventName: e,    eventData: a,    LAPPNAME: k.lappname ?? C.lappname  };  try {    await fetch(o, {      method: "POST",      headers: {        "Content-Type": "application/json"      },      body: JSON.stringify(l),      mode: "no-cors"    })  } catch {}}
Fields in each analytics POST
  • Profile email
    jane.doe@gmail.com

    Ties each event to the Google account signed in to your browser.

  • Stored user ID
    cf_8f3a91c2d7

    A persistent ID that links events from the same install.

  • Page URL
    https://www.example.com/listings?page=2

    The address of the page you scraped, sent on extraction and export events.

  • Page title
    Example Listings - Page 2

    The title of the scraped page, sent with the same events.

Hosts contacted by the analytics code
    • chatph.thinksolv.com

    Receives JSON analytics events including profile email and page URLs.

    • cf-userid-generator.aruchamyvikram.workers.dev

    Issues the user ID that is cached locally and added to events.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Web Scraper Pro contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chatph.thinksolv.com

    Web Scraper Pro sends data to chatph.thinksolv.com. 2 other extensions we have analysed send data here.

Updated 15 October 2026mdlllfgflmhlfjpdjggpbncdjgckcaan