Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware] (+2.0, capped).
• Gmail developer (ongtookcirob@gmail.com) with no business domain raises unverifiable identity risk.
• Privacy policy is Google's generic account policy — does not scope data handling to this extension.
• install_url_hijack=true: extension opens a URL on install with unknown target.
• <all_urls> host permission + content_scripts on all URLs enables broad page-content access.

Evidence

• developer_email_free_webmail store Developer email ongtookcirob@gmail.com — free webmail, no verifiable business identity.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_policy_classification_scope_false api scope_extension=false, data_collection=true, third_party_sharing=true — worst-case Privacy pillar.
• install_url_hijack crx install_url_hijack=true with null target recorded; extension triggers URL open on install.
• host_permission_all_urls manifest <all_urls> in host_permissions with content_scripts on <all_urls>; full page access.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• js_external_host_translateextension_xyz crx translateextension.xyz is a dev-controlled domain of unknown trustworthiness among external hosts.
• featured_by_google store is_featured_by_google=true; partial trust signal offsetting reputation somewhat.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware]; score 5.09 -> 7.09 (+2.0 cap 2.5).

Permissions Breakdown

• contextMenus low Adds right-click translate option; low standalone risk.
• storage low Stores user settings locally; minimal risk.
• tabs medium Can read tab URLs and titles across all open tabs.
• system.display low Read display info; unusual for translator but low impact.
• declarativeNetRequest medium Can modify/block network requests; paired with <all_urls> raises concern.
• activeTab low Access limited to user-activated tab; scoped.
• <all_urls> (host_permission) high Content scripts injected on every URL; broad data access surface.

Pillar Scores

Bookkeeping