  Web-based chatbots provide website owners with the benefits of increased
sales, immediate response to their customers, and insight into customer
behaviour. While Web-based chatbots are getting popular, they have not received
much scrutiny from security researchers. The benefits to owners come at the
cost of users' privacy and security. Vulnerabilities, such as tracking cookies
and third-party domains, can be hidden in the chatbot's iFrame script. This
paper presents a large-scale analysis of five Web-based chatbots among the top
1-million Alexa websites. Through our crawler tool, we identify the presence of
chatbots in these 1-million websites. We discover that 13,515 out of the top
1-million Alexa websites (1.59%) use one of the five analysed chatbots. Our
analysis reveals that the top 300k Alexa ranking websites are dominated by
Intercom chatbots that embed the least number of third-party domains. LiveChat
chatbots dominate the remaining websites and embed the highest samples of
third-party domains. We also find that 850 (6.29%) of the chatbots use insecure
protocols to transfer users' chats in plain text. Furthermore, some chatbots
heavily rely on cookies for tracking and advertisement purposes. More than
two-thirds (68.92%) of the identified cookies in chatbot iFrames are used for
ads and tracking users. Our results show that, despite the promises for
privacy, security, and anonymity given by the majority of the websites,
millions of users may unknowingly be subject to poor security guarantees by
chatbot service providers
