Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by bleepingcomputer.com
Chatgpt PDF | Ask your pdf
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 1 weeks ago
- Version
- v1.4.8
- Artifact
- SHA256 65A…561
- Source
- Findings (non-IoC)
Is Chatgpt PDF | Ask your pdf safe?
Chatgpt PDF | Ask your pdf is a Chrome extension that summarizes PDFs and lets you ask questions about them. It declares no permissions and no host permissions, which means it cannot read the pages you browse, click for you, or reach your cookies. What it does have is outbound network access: the code contacts api.pdfsummary.ai and staging.pdfsummary.ai for the summarization service, api.eu.amplitude.com and o4506502203441152.ingest.sentry.io for usage statistics and crash reports, and Firebase hosts (summary-ai-project.appspot.com, summary-ai-project.firebaseapp.com) that back the same service. All of that is normal for a tool that sends your document text to a server and gets a summary back.
The results that look alarming are mostly scanner noise. Two high-severity entries, OBFUSCATION-INVISIBLE_ZERO_WIDTH-_locales/kn/messages.json and the matching Telugu file, flag invisible zero-width characters in the Kannada and Telugu translation files, where those characters are part of the writing systems themselves. The code-smell hits and the long list of flagged domains come from the minified bundles such as assets/vendor-S3N9t8RP.js, where the extractor reads things like window.chrome and navigator.online as if they were web addresses. No malware signature matched anything.
One file is worth naming on its own: src/action/extads-sdk.js, which fetches config.ext-ads.com. That is an advertising SDK, so this free extension makes money by serving ads inside its own pages. It is a reason to know what you are installing. It does not give the extension a way to change your search engine, alter the pages you visit, or read your logins, because it holds no permission to do any of that. Watching that SDK run would confirm the last open question.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
12 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | credential env files | 1 | assets/vendor-S3N9t8RP.js | - |
| LOW | postinstall persistence mechanism | 1 | assets/vendor-S3N9t8RP.js | - |
| LOW | postinstall file download | 8 | assets/modulepreload-polyfill-9p4a8sJU.jsassets/vendor-S3N9t8RP.jsassets/main.ts-HfIqhtop.js +5 more | - |
| LOW | NoUseWeakRandom | 1 | assets/vendor-S3N9t8RP.js | - |
| LOW | LocalStorageShouldNotBeUsed | 1 | src/action/extads-sdk.js | - |
| LOW | postinstall crypto operations | 3 | _metadata/verified_contents.jsonsrc/action/extads-sdk.jsassets/vendor-S3N9t8RP.js | - |
| LOW | postinstall system command | 6 | assets/vendor-S3N9t8RP.jsassets/main.ts-HfIqhtop.jsassets/index-0LaEjMRK.css +3 more | - |
| LOW | postinstall file manipulation | 3 | assets/main.ts-HfIqhtop.jsassets/vendor-S3N9t8RP.jssrc/action/extads-sdk.js | - |
| LOW | postinstall environment access | 5 | assets/fetch-xhr-YPil_cUy.jsassets/Button-iM3-HG2A.jsassets/vendor-S3N9t8RP.js +2 more | - |
| LOW | postinstall registry modification | 1 | assets/vendor-S3N9t8RP.js | - |
| LOW | postinstall obfuscation | 2 | assets/vendor-S3N9t8RP.jsassets/api-9wCeKcLE.js | - |
| LOW | postinstall network communication | 8 | assets/fetch-xhr-YPil_cUy.jssrc/action/banner-init.jsassets/vendor-S3N9t8RP.js +5 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
12 rules(40 hits)Requested Permissions
3 permissionsAccess and modify data on every website you visit
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
Chatgpt PDF | Ask your pdf, version 1.4.7, sends document text to a hosted service and returns a summary or an answer. The manifest declares no permissions and no host permissions. That single fact shapes everything below: without host permissions the extension cannot read arbitrary pages, inject scripts into sites you visit, replace your search engine or new tab page, or touch HTTP cookies. Its reach is its own extension pages plus outbound fetch calls.
No malware signature matched any file in the package. The categories that would point at delivered payloads or stolen data are empty.
The two high-severity entries are OBFUSCATION-INVISIBLE_ZERO_WIDTH-_locales/kn/messages.json and the same rule against _locales/te/messages.json. Kannada and Telugu use zero-width characters as part of ordinary orthography, so flagging translation files for invisible characters says something about the scanner, not about the extension.
Code-smell rules fire throughout the bundled output. assets/vendor-S3N9t8RP.js carries several of the fetch findings on its own, alongside assets/modulepreload-polyfill-9p4a8sJU.js and assets/api-9wCeKcLE.js. These are webpack-style chunks, minified library code that trips rules written for readable source.
The IoC list follows the same pattern. window.chrome, navigator.online, bt.chrome, button.bg, pp.tc and xe.group are property access chains and hex fragments lifted out of minified JavaScript, not endpoints. The destinations that do exist are the extension's own service (api.pdfsummary.ai, staging.pdfsummary.ai, summary-ai-project.appspot.com, summary-ai-project.firebaseapp.com), product analytics (api.eu.amplitude.com, api2.amplitude.com) and error reporting (o4506502203441152.ingest.sentry.io). A hosted summarizer needs all three.
The strongest counterargument is src/action/extads-sdk.js, which fetches config.ext-ads.com. That is a real observation: the extension ships an advertising SDK and pulls its configuration from a remote server, so some of its behaviour is decided after install and cannot be read from this package. Free extensions commonly monetize this way, and the SDK runs in the extension's own context. It holds no permission to modify pages, redirect searches or read credentials, and no malware rule matched the file. Reading that fetch as ad monetization is better supported by the evidence than reading it as hijacking, though runtime observation of what the SDK does with the returned configuration would settle it.
The scan volume is large, and its composition is what matters: code-smell rules firing across bundled libraries, a domain list dominated by parse artifacts, locale files flagged for characters that belong to their writing systems, and fetch calls in vendor and service code. None of it describes behaviour that harms a user, and none of it survives contact with the file paths it came from.
Key Reasons
- Zero malware signatures matched; the malware and data-exfiltration categories are empty
- Manifest declares no permissions and no host permissions, ruling out page injection, search hijack and cookie access
- Both high-severity obfuscation hits are zero-width characters in _locales/kn/messages.json and _locales/te/messages.json, normal Kannada and Telugu orthography
- Network findings are fetch calls inside minified bundle chunks (assets/vendor-S3N9t8RP.js, assets/modulepreload-polyfill-9p4a8sJU.js) and the extension's own API client
- src/action/extads-sdk.js fetching config.ext-ads.com is ad monetization in the extension's own context, not code that alters browsing
False Positive Considerations
- OBFUSCATION-INVISIBLE_ZERO_WIDTH fires on _locales/kn/messages.json and _locales/te/messages.json because zero-width characters are ordinary Kannada and Telugu orthography
- Code-smell rules fire on minified bundle chunks such as assets/vendor-S3N9t8RP.js and assets/modulepreload-polyfill-9p4a8sJU.js
- IoC matches include property access chains and hex fragments misread as domains (window.chrome, navigator.online, button.bg, pp.tc, xe.group)
- Remaining endpoints are the extension's own API, Amplitude analytics and Sentry error reporting
Reviewed 2026-09-27; recommended action: suppress false positive; model confidence 78%.
Chrome version history
Risk trend by version
5 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]
LinkVault Professional
[email protected]