Top Risks

• Privacy policy covers deepl.com broadly but is not scoped to this extension; admits data collection and third-party sharing.
• content_scripts on <all_urls> with webRequest and cookies permissions creates broad page-access surface across all sites.
• new Function() constructor found in bundled tesseract/worker.min.js; limited risk as it appears in a globalThis detection pattern.
• No developer_name field populated in manifest; deepl.com domain resolves and email matches but store identity gap exists.
• AI translation extension processes page content on 4M installs; data routed to deepl.com API endpoints.

Evidence

• content_scripts_broad manifest content_scripts matches <all_urls> — injects into every page visited.
• webRequest+cookies manifest webRequest and cookies declared; host_permissions scoped to *.deepl.com only.
• privacy_policy_not_extension_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• function_constructor crx new Function() in tesseract/worker.min.js — globalThis detection pattern, low exploitation risk.
• featured_by_google store is_featured_by_google=true; provides partial trust signal.
• no_bad_hosts_or_monetization api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits.
• no_cves crx cve_findings_raw is empty; no known vulnerable libraries detected.
• recently_updated store months_since_update=0; actively maintained extension.

Permissions Breakdown

• activeTab low Accesses current tab on user action only.
• storage low Local settings/preferences storage.
• contextMenus low Adds right-click translate option.
• tabs medium Can read tab URLs and titles across all tabs.
• scripting medium Can inject scripts into pages; paired with <all_urls> content scripts.
• declarativeNetRequest medium Can modify/block network requests declaratively.
• identity low OAuth identity for user account login.
• tts low Text-to-speech for translation playback.
• alarms low Periodic background tasks.
• webRequest high Can observe all network requests matching host_permissions.
• cookies high Can read/write cookies; scoped to *.deepl.com only.
• sidePanel low Side panel UI for translation interface.
• content_scripts:<all_urls> high Injects into every page; core translation function but broad surface.

Pillar Scores

Scoring History

Bookkeeping