Hi everyone! I’m looking for some technical advice on Chrome, Google account synchronization, browser extensions, and data security.
During previous investigations into unexpected browser behavior, I found that Chrome’s extension Developer Mode had been enabled, along with records referencing extensions with automation capabilities, including TwSearchExporter, X Unfollower/Xtensions, ReDeck, and Hola.
I’m aware that having these extensions installed doesn’t necessarily mean anything malicious happened. What I’m trying to understand is their origin, permissions, and potential impact on browser behavior.
I also noticed that certain settings seemed to carry over into Chrome when I signed in with my Google account. Around the same time, I experienced issues with some websites, including ChatGPT.
I haven’t been able to determine whether these behaviors were related to Chrome Sync, local browser settings, extensions, or browser policies.
I also understand that signing into a Google account doesn’t automatically mean Chrome Sync is enabled.
The original extension installations are no longer available for direct inspection. However, I’ve preserved browsing history records from Safari and Chrome Desktop, including references to extensions, authentication flows, and redirects.
Another concern: Chrome DevTools (Network tab)
When I open DevTools, I frequently see the red recording indicator enabled in the Network tab.
I understand that this is normal behavior and that DevTools records network requests made by the page.
However, when stopping the recording, I noticed activity that initially made me wonder whether data was being transmitted elsewhere.
I haven’t identified any external destination or confirmed that a transfer actually occurred.
What I’d like to understand is how to distinguish normal Network activity from requests potentially generated by extensions or scripts.
I’m also concerned about what information related to images, documents, cached content, and authentication sessions might remain stored in the browser, and under what circumstances someone with access to my Google account or an authenticated device could retrieve it.
What I’ve observed or identified
● Preserved browsing history records from Safari and Chrome Desktop.
● Historical references to extensions with automation capabilities.
● Chrome extension Developer Mode previously enabled.
● Authentication and redirect records.
● Unexpected behavior affecting certain ChatGPT features.
● The active recording indicator in the DevTools Network tab.
● Original extension installations no longer available for direct examination.
What I’m trying to figure out
1. How can I identify settings restored through Chrome Sync and distinguish them from local settings or managed browser policies?
2. Is it possible to investigate the permissions or past activity of removed extensions using preserved browsing history?
3. Could browser extensions interfere with ChatGPT features such as file uploads, downloads, or local storage? How could I verify whether this happened?
4. How can I distinguish normal DevTools Network requests from potential data transmissions initiated by extensions or scripts?
5. What browser data can be synchronized or recovered by someone with access to a Google account or another authenticated device?
6. What’s the safest way to create a clean Chrome profile without restoring unwanted settings or compromising previously preserved records?
My goal
I’m not claiming that my browser was compromised, that I was monitored, or that any files were transferred without authorization.
I want to separate documented observations from assumptions, understand what the available records can actually establish, and determine which technical checks are still possible.
Ultimately, I’d like to identify the origin of these settings, assess any genuine privacy risks, and use my Google account in a clean, trustworthy browser environment without losing the records I’ve preserved.
If anyone has experience with Chrome Sync, DevTools, chrome://policy, chrome://sync-internals, or browser extension forensics, I’d really appreciate recommendations for reliable troubleshooting steps or investigative tools.
Thanks in advance!