Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Chatgpt Assistant Gpt Sea + malext.io malicious_extension_sentry (+2.5, capped).
• Generic privacy policy admits data collection and 3rd-party sharing without extension-specific scope
• Free webmail developer (gmail.com) with no verified business identity
• Brand impersonation: 'ChatGPT' in title without OpenAI affiliation
• Stale maintenance: 19 months since last update

Evidence

• privacy_policy_generic store Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true
• developer_identity store Free webmail (gmail.com), no verified publisher badge, no business domain
• brand_impersonation store Title contains 'ChatGPT' but no confirmed OpenAI ownership
• maintenance_stale store 19 months since last update (February 2025)
• manifest_unavailable store html_fallback source, permissions unknown
• low_installs store 549 installs, limited track record
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Chatgpt Assistant Gpt Sea + malext.io malicious_extension_sentry; score 6.80 -> 9.30 (+2.5 cap 2.5).

Permissions Breakdown

• unknown medium Manifest unavailable (html_fallback); AI extensions typically require broad host access

Pillar Scores

Bookkeeping