Is Wise Owl safe?
Wise Owl sends your Chegg login session token to unblur.top and related servers when fetching solutions.
On Chegg expert and homework-help pages, the extension reads the id_token session cookie and attaches it to requests sent to unblur.top, spacemail.top servers, or to server-supplied links. The server list is downloaded from unblur.top, so the destination can change remotely. It also sends the first 500 characters of the question text to the same server.
Who publishes itAlcazar - 1 other listing from the same operator, 1 of them carrying a finding
Alcazar - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 5k+ users between them. 1 of them carries a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Chegg login token is appended to requests sent to a remotely listed server
Code analysis shows the extension reads the Chegg id_token cookie and sends it as a URL parameter to unblur.top or spacemail.top servers, whose list is fetched remotely.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You click Copy or Fetch on a Chegg answer page.
This runs on expert.chegg.com and Chegg Q&A pages.
The extension reads your Chegg login token and sends it to a third-party server.
The token is placed in the URL as code=.
Token read and request construction
Server list fetched remotely, with hardcoded fallback
chegg.jsfetchServers() { let e = ["https://unblur.top", "https://primary.spacemail.top", "https://secondary.spacemail.top"]; fetch("https://unblur.top/servers", { method: "GET" }).then(e => e.json()).then(e => { localStorage.setItem("servers", JSON.stringify(e.servers)) }).catch(t => { localStorage.setItem("servers", JSON.stringify(e)) })}- Chegg id_tokencode=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9... (illustrative)
Session JWT from your Chegg cookie, sent as code=.
- Question linklink=https://www.chegg.com/homework-help/questions-and-answers/example-q123456789
The Chegg URL or ID you typed into the prompt.
- Question textA ball is thrown upward with an initial speed of 12 m/s...
First 500 characters of the question, sent to /solution/choices.
- unblur.top
Serves the server list and receives the token and links.
- primary.spacemail.top
- secondary.spacemail.top
Fallback server that receives the same requests.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Wise Owl contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- primary.spacemail.top
Wise Owl sends data to primary.spacemail.top. No other extension we have analysed sends data here.
- secondary.spacemail.top
Wise Owl sends data to secondary.spacemail.top. No other extension we have analysed sends data here.
- unblur.top
Wise Owl sends data to unblur.top. No other extension we have analysed sends data here.