Urban Browser Guard Sends ChatGPT Conversations to Vendor Endpoint

Overview

Urban Browser Guard is a Chrome extension with 300,000 installs that embeds a content script on AI chat sites, including ChatGPT, and constructs a message containing the user's chat text. The message is sent to the extension's service worker, which is configured with a vendor endpoint (https://guardrail.urban-vpn.com/rest/v1) capable of receiving the text. The transmission is gated behind an in-page PII-consent notification with agree/reject options, so the exposure is consent-mediated but real.

How it works

The content script (content/index.js) detects when the user is on a supported AI chat site by checking for specific page elements, such as a user menu button on chatgpt.com. When a conversation is detected, the script builds a CHECK_PII message from the current thread. In sdk/resource.js, the message data includes the chat text, session identifiers, and a room value set to "chatgpt.com". The message is passed to the service worker.

The service worker (service-worker/index.js) contains a handler for CHECK_PII messages. The handler references a configuration object with host "https://guardrail.urban-vpn.com/rest/v1", a product identifier, and a cloud-detection default state. The manifest grants host permission to guardrail.urban-vpn.com, allowing the extension to make requests to that domain. If the user agrees to the PII-consent notification, the chat text can be transmitted to the vendor's server for cloud scanning.

Payload

The payload sent to the vendor endpoint is not fully captured in the static analysis due to minification, but the CHECK_PII message structure includes the user's chat text, a user session token, a room session token, and a message type. The exact network request format is unknown; however, the service worker is designed to forward the message data to the guardrail endpoint.

Store status

The extension is currently active on the Chrome Web Store. The store page likely discloses the AI-chat scanning feature, but the risk lies in the consent flow and the extent of data collection. Users who reject the PII consent should not have their chat text transmitted, but the default state of consent (cloudDetectionDefaultState) could not be confirmed from the code and the sandbox run failed. Therefore, the default behavior for new users is uncertain.