Is AnswerAI - Homework AI Tutor & Study Helper safe?
We analyzed AnswerAI - Homework AI Tutor & Study Helper version 1.5.4's actual code and gave it a 25/100 trust score. This AI assistant has broad all-site…
Bottom line
This AI assistant has broad all-site access and a serious flaw that can expose its login data to ordinary websites.
What it can access
It works across every website and can read selected page content, use media, and alter fields for its assistant features.[Q1][Q2] It also stores login data and can expose it to pages.[Q5][Q14]
Security weaknesses
Any website can use an unrestricted bridge to obtain or replace the extension’s login data.[Q16][Q21] This creates a serious account-takeover risk if a malicious page uses it.[Q14]
Signs of misuse
The extension sends questions, page context, and selected media to its service.[Q6] It also sends persistent device and usage identifiers for analytics.[Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access to every website plus tabs, scripting, activeTab, clipboard writing, storage, context menus, and network-rule controls. Much of this supports its cross-site AI assistant, but the scope is exceptionally broad.
Declares <all_urls> host access, two all-site content scripts, tabs, scripting, activeTab, clipboardWrite, unlimitedStorage, contextMenus, and declarativeNetRequest permissions. — manifest.json:3
Registers additional social-site and all-site image-hover scripts, enabled by default on installation. — static/background/index.js:58
Which websites can it run on, and can it read or change what appears on those pages?
It can run on every webpage, read page and social-post content, inspect images and video, add AI controls, and place generated text into inputs. These capabilities are used for its advertised assistant features.
Loads relayMessage and root-container scripts on <all_urls>. — manifest.json:3
Attaches to editable fields, extracts page or post context, prepares media, and can return up to 8,000 characters of page text. — vendor/orca/content.js:190-300,371-630,1940-1965
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It attaches listeners to text inputs and contenteditable fields on supported pages and can read the text used to invoke AnswerAI. The traced flow sends input and surrounding content only after an AnswerAI trigger; passive password or payment-field collection was not demonstrated.
Finds editable elements, attaches the AnswerAI trigger, and reads the input text when the user invokes it. — vendor/orca/content.js:190-300,371-473
Builds the user-triggered askGoat message from the question, page context, and selected media. — vendor/orca/content.js:608-630
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores an AnswerAI bearer token, expiry data, user profile, device ID, settings, and conversation-related state. It does not request Chrome cookie or history permissions.
Stores token, token_expire, token_refresh_after, user_info, device_id, and product state through extension storage. — static/background/index.js:1
Declares storage and tabs but not cookies or history. — manifest.json:3
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write to the clipboard, capture the visible active tab, process webpage images and video frames, and upload user-selected PDFs. It has no native-messaging, camera, microphone, or general file-system permission.
Declares clipboardWrite and activeTab, without nativeMessaging, camera, microphone, or file-system permissions. — manifest.json:3
Implements captureVisibleTab plus image and PDF upload handlers. — static/background/index.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
User questions, extracted page or social-post context, and selected media can be sent to ext.answerai.pro. Usage events with persistent identifiers go to etpweb.answerai.pro, and error details can go to Sentry.
Collects the question, page context, comments, transcripts, and media, then sends them to the background AI handler. — vendor/orca/content.js:371-630
Posts authenticated AI requests to https://ext.answerai.pro/api/v1 and initializes analytics at https://etpweb.answerai.pro/event/report/web. — static/background/index.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads AnswerAI configuration, feature flags, plan data, and AI responses. These values control features and generated content, but no downloaded JavaScript was shown reaching an execution sink.
Fetches AnswerAI API configuration and GrowthBook feature flags from fixed HTTPS services. — static/background/index.js:1
Applies a server-supplied attribution suffix to inserted AI text; it treats the value as text, not code. — vendor/orca/adapters/base-adapter.js:2016-2035
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It injects interfaces and analytics code automatically on matching pages, opens a welcome page on install, and maintains first-party network rules. Sending page content, screenshots, PDFs, or edit requests requires a user interaction in the traced paths.
Registers default-enabled content scripts, opens AnswerAI's welcome page on install, and installs scoped header rules. — static/background/index.js:58
The AI request path starts from an AnswerAI trigger and performs an authentication check before sending content. — vendor/orca/content.js:300-354,608-630
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Changes Content-Type, Origin, X-Requested-With, and CORS response headers only for etpweb.answerai.pro. — header.7c1f959a.json:1-30
Adds an Accept-Language header rule scoped to ext.answerai.pro. — static/background/index.js:58
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Several core bundles are heavily minified and exceed 8-10 MB, which makes review difficult. The important network, token, and Orca behavior was still traceable, and substantial Orca source is readable.
Lists multi-megabyte minified root-container, chat, PDF, popup, options, and background bundles. — inventory.json:1-1450
Contains readable source for the cross-site social assistant behavior. — vendor/orca/content.js:1-2212
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains PDF.js eval('require'), a Lottie expression eval, and document-script Function constructors. — tabs/pdfChat.e221331e.js:25,176,203
Contains the same bundled document and animation execution helpers. — tabs/chatTab.fc597dc9.js:44,90
Manifest V3 declares no custom CSP allowing unsafe-eval. — manifest.json:3
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Includes pageUrl in extracted context used by user-triggered AI requests. — vendor/orca/content.js:371-630,1940-1965
Sends window.location.href with a submitted image-edit request. — vendor/orca/orca-image-hover.js:1377-1400
Does it create a persistent ID or browser fingerprint to recognize you?
It creates persistent device identifiers and sends them with user ID, browser user agent, install time, extension version, and product-interaction events to AnswerAI analytics. The Orca shim records feature and social-platform categories, not arbitrary page URLs.
Adds mid/device identifiers to API and analytics payloads and packs user ID, user agent, install time, version, and event properties. — static/background/index.js:1,58
Forwards named Orca usage events and social-platform labels to the background tracker. — vendor/orca/analytics-shim.js:21-48
Does it send cookies, session details, authentication data, or page contents elsewhere?
A confirmed all-site bridge exposes the stored AnswerAI bearer token, token expiry, and user profile to any webpage. This is a reachable authentication vulnerability; it is not merely a normal request to the service the user is using.
Loads relayMessage.e92aae5e.js on <all_urls>. — manifest.json:3
Accepts getExtToken from window.postMessage without checking an origin allowlist and posts the privileged response back to the page. — relayMessage.e92aae5e.js:1
The getExtToken handler reads token, token_expire, and user_info from extension storage and returns all three. — static/background/index.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture a user-selected screenshot region, page images, video frames, limited TikTok audio, and text from editable fields. These capture paths are tied to visible AnswerAI actions; passive keystroke logging was not demonstrated.
Captures media for a triggered AI request and provides a visible drag-and-confirm screenshot selection UI. — vendor/orca/content.js:300-630,1208-1524
Implements captureVisibleTab and image upload for OCR. — static/background/index.js:1
Can a website or remote server send commands that make the extension take actions?
Any webpage can use the relay to read or replace the AnswerAI login token, request account information, open extension UI, or log the extension out. The only check is that the message source is the same page window; there is no trusted-origin check.
Registers info, getExtToken, login, login/fromWebScan, openExtWindow, and logout relays and validates only message source, name, and optional relay ID. — relayMessage.e92aae5e.js:1
The login/fromWebScan handler stores supplied access-token data, while getExtToken returns stored authentication data. — static/background/index.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The Insert button writes the generated answer plus a server-controlled suffix into the current input. — vendor/orca/adapters/base-adapter.js:1128-1156,1980-2035
Mounts AnswerAI controls beside detected editable fields. — vendor/orca/content.js:190-243
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It rewrites headers only for AnswerAI's own analytics and services requests and can download a user-selected PDF URL for upload. No general proxy, unrelated traffic interception, or silent download was demonstrated.
Scopes packaged header changes to etpweb.answerai.pro. — header.7c1f959a.json:1-30
Adds a scoped API language header and implements a bounded PDF download handler. — static/background/index.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:3
Includes localhost development page matches for a browser-page bridge, not native or local-service communication. — inject.c3f17983.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Consumes fixed-service responses as JSON, text, feature flags, or image URLs. — static/background/index.js:1
Contains execution helpers, but the reviewed package did not connect remote AnswerAI data to them. — tabs/pdfChat.e221331e.js:25,176,203
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites have an unrestricted privileged bridge. A page can post a getExtToken message, the all-site page access forwards it to the background, and the response returns the bearer token, expiry, and profile to that page.
Runs the relay content script on every HTTP, HTTPS, and other permitted webpage. — manifest.json:3
Forwards matching window messages without an origin allowlist and posts results back using the caller-supplied instance ID. — relayMessage.e92aae5e.js:1
Returns env, token, expiry, and userinfo for getExtToken and accepts supplied tokens through login handlers. — static/background/index.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Loads GrowthBook feature settings and registers social and all-site image tools according to stored defaults. — static/background/index.js:1,58
Statically injects the vulnerable relay on <all_urls>; no remote switch is required for that path. — manifest.json:3
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The large worker and library files correspond to PDF, rendering, image, and AI application components. — inventory.json:1-1450
Network endpoints are AnswerAI, analytics, experiments, and error reporting rather than mining pools. — static/background/index.js:1-58
Does it change form fields or where a form sends its information?
After the user presses Insert, it replaces the active text field or contenteditable content with the AI response and a possible server-controlled attribution suffix. It does not change form actions or automatically submit the form.
Insert click handlers set input values or use insertText, then append a cloud-controlled suffix at insertion time. — vendor/orca/adapters/base-adapter.js:1128-1156,1980-2035
The insertion helper explicitly avoids synthetic Enter behavior that could auto-submit. — vendor/orca/adapters/base-adapter.js:2063-2078