Top Risks

• Critical CVE in bundled underscore@1.8.3 (CVE-2021-23358 ACE) + high CVE (CVE-2026-27601 DoS); not patched.
• Privacy policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — admits broad sharing without extension-specific scope.
• uninstall_url_hijack=true: extension sets an uninstall URL to a third-party destination.
• eval() in opencv.js and widespread new Function() across 104 JS files alongside <all_urls> content scripts.
• Free-webmail developer (ttop324@gmail.com) with brand mention of YouTube/Netflix flagged as impersonation; no verified publisher.

Evidence

• CVE critical+high in underscore@1.8.3 crx CVE-2021-23358 (ACE, fixed 1.12.1) and CVE-2026-27601 (DoS, fixed 1.13.8); bundled version 1.8.3 unpatched.
• Privacy policy: collection+third_party_sharing admitted, scope_extension=false api Policy exists on GitHub but does not scope to this extension; admits data collection and third-party sharing.
• uninstall_url_hijack=true crx chrome.runtime.setUninstallURL() points to a third-party URL; exfil/monetization risk on uninstall.
• eval + new Function across 20 code findings crx eval() in opencv.js; new Function() in contentScript.js, netflix.js, alert.js and 16 other files.
• brand_mention impersonation: YouTube, Netflix store is_impersonation=true; confirmed_owner=false; developer domain is gmail.com.
• Free-webmail developer, no verified publisher store ttop324@gmail.com; verified_publisher=false; featured by Google provides partial trust signal.
• <all_urls> host_permission + scripting manifest Content scripts inject on all URLs; scripting API enables dynamic injection across every visited page.
• cdn.jsdelivr.net in js_external_hosts crx Extension references external CDN (jsdelivr.net); CSP allows only 'self', mitigating remote load risk.

CVE Exposures (2)

Permissions Breakdown

• storage low Saves user settings locally; standard for translation tools.
• tts low Text-to-speech output; aligns with translation function.
• tabs medium Can read tab URLs and titles across all open tabs.
• scripting high Programmatic script injection into pages; elevated when paired with <all_urls>.
• contextMenus low Adds right-click menu entries; limited impact.
• offscreen low Off-screen document for audio/DOM ops; contained scope.
• search medium Can query default search engine; minor data exposure.
• <all_urls> (host_permission) high Content scripts run on every site; broad data access surface.

Pillar Scores

Scoring History

Bookkeeping