Speech Translator
jodfjmaiakpnmeddgpeflpafebmlhppn
Risk Score
5.62
Risk Level:
Medium
Recommendation:
🟡 MEDIUM RISK — review
Top Risks
- Critical CVE-2021-23358 (Arbitrary Code Execution) in bundled underscore@1.8.3, unfixed for 30+ months.
- High CVE-2026-27601 (DoS via recursion) in same underscore@1.8.3 bundle.
- Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
- Extension not updated in 30 months; stale MV3 with known-vulnerable library presents growing attack surface.
- Developer name absent from listing; no verified-publisher discount applicable to privacy/CVE risk.
Evidence
- critical_cve crx underscore@1.8.3 has CVE-2021-23358 (ACE); fixed in 1.12.1; bundled at vulnerable version.
- high_cve crx underscore@1.8.3 has CVE-2026-27601 (DoS); fixed in 1.13.8; bundled at vulnerable version.
- stale_extension store Last updated December 2023; 30 months since update with unpatched CVEs.
- generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
- verified_publisher store verified_publisher=true but cap applies: months_since_update>18 and cve_findings_raw non-empty.
- no_developer_name store developer_name is empty string; reduces accountability signal.
- external_hosts_diverse crx 12 external JS hosts including speech.microsoft.com, boosty.to, obsproject.com; geo diversity=1 country (IN).
- csp_present_mv3 manifest CSP present, MV3; connect-src scoped to translation endpoints and kappaflow.dev.
Permissions Breakdown
- notifications medium Can display notifications; low abuse potential standalone.
- storage low Local data persistence only.
- activeTab medium Access to current tab on user gesture; bounded scope.
- scripting medium Can inject scripts into active tab; medium risk without broad host access.
- system.display low Read display info; minimal abuse surface.
- contextMenus low Adds context menu items; low risk.
- sidePanel low Side panel UI; no data exfil risk alone.
- host:script.google.com medium Google Apps Script endpoint; scoped, translation plausible.
- host:translate.googleapis.com low Google Translate API; matches stated purpose.
- host:*.kappaflow.dev medium Developer domain; wildcard subdomain, potential future expansion.
Pillar Scores
Permissions3.00
Reputation4.00
Network2.50
Webstore1.50
Maintenance8.50
Privacy10.00
Code Quality0.00
CVE Exposure7.00
Scoring History
| <fsssiedxi$'sssiedx | 1.44 | Low | review | 2026-08-18 |
| <fsssiedxg | 3.54 | Low | review | 2026-08-10 |
| xx pfsssiedxffdsaxax><!--></ScRiPt>asddsssiedx | 3.21 | Low | review | 2026-08-10 |
| %22fsssiedxf$'sssiedx | 1.84 | Low | review | 2026-08-10 |
| %27fsssiedxf$"sssiedx | 1.57 | Low | review | 2026-08-10 |
| 'fsssiedxf sssiedx | 1.71 | Low | review | 2026-08-10 |
| "fsssiedxffdsaxax><!--></ScRiPt>asddsssiedx | 3.59 | Low | review | 2026-08-10 |
| <fsssiedxf"sssiedx | 1.75 | Low | review | 2026-08-10 |
| <fsssiedx{ xx psssiedx | 3.07 | Low | review | 2026-08-10 |
| <fsssiedx{$'sssiedx | 3.49 | Low | review | 2026-08-10 |
| xx pfsssiedxasssiedx | 3.22 | Low | review | 2026-08-09 |
| xx pfsssiedxa$"sssiedx | 3.30 | Low | review | 2026-08-09 |
| 'fsssiedxa"sssiedx | 1.62 | Low | review | 2026-08-09 |
| 'fsssiedxafdsaxax><!--></ScRiPt>asddsssiedx | 3.52 | Low | review | 2026-08-09 |
| 'fsssiedxa$"sssiedx | 3.30 | Low | review | 2026-08-09 |
| "fsssiedxafdsaxax><!--></ScRiPt>asddsssiedx | 3.19 | Low | review | 2026-08-09 |
| fsssiedxa"sssiedx | 3.22 | Low | review | 2026-08-09 |
| "fsssiedxasssiedx | 3.36 | Low | review | 2026-08-05 |
| 'fsssiedxa"sssiedx | 3.49 | Low | review | 2026-08-05 |
| %27fsssiedxa sssiedx | 2.62 | Low | review | 2026-08-05 |
| 'fsssiedxa'sssiedx | 3.11 | Low | review | 2026-08-05 |
| 'fsssiedxa sssiedx | 3.29 | Low | review | 2026-08-05 |
| 3.38 | Low | review | 2026-08-05 | |
| "fsssiedxa$'sssiedx | 3.00 | Low | review | 2026-08-05 |
| $'fsssiedxa sssiedx | 3.02 | Low | review | 2026-08-05 |
| fsssiedxa$'sssiedx | 3.22 | Low | review | 2026-08-05 |
| <fsssiedxi xx psssiedx | 3.37 | Low | review | 2026-08-04 |
| <fsssiedxi'sssiedx | 3.57 | Low | review | 2026-08-04 |
| <fsssiedxi | 3.10 | Low | review | 2026-08-04 |
| <fsssiedxi$"sssiedx | 3.14 | Low | review | 2026-08-04 |
| <fsssiedxa'sssiedx | 1.80 | Low | review | 2026-08-04 |
| %22fsssiedxa xx psssiedx | 3.25 | Low | review | 2026-07-31 |
| %27fsssiedxa$'sssiedx | 3.38 | Low | review | 2026-07-31 |
| "fsssiedxa sssiedx | 3.14 | Low | review | 2026-07-31 |
| fsssiedxa$"sssiedx | 3.26 | Low | review | 2026-07-31 |
| <fsssiedxa'sssiedx | 1.57 | Low | review | 2026-07-31 |
| <fsssiedxa"sssiedx | 3.37 | Low | review | 2026-07-31 |
| <fsssiedxa$'sssiedx | 3.25 | Low | review | 2026-07-31 |
| <fsssiedxa xx psssiedx | 3.38 | Low | review | 2026-07-31 |
| <fsssiedxa$"sssiedx | 2.54 | Low | review | 2026-07-31 |
| <fsssiedxa"sssiedx | 3.46 | Low | review | 2026-07-31 |
| fsssiedxa<sssiedx | 3.25 | Low | review | 2026-07-31 |
| <fsssiedx{"sssiedx | 3.47 | Low | review | 2026-07-28 |
| <fsssiedx{$"sssiedx | 3.07 | Low | review | 2026-07-28 |
| <fsssiedxhfdsaxax><!--></ScRiPt>asddsssiedx | 3.06 | Low | review | 2026-07-28 |
| <fsssiedxh"sssiedx | 3.26 | Low | review | 2026-07-28 |
| <fsssiedxh'sssiedx | 3.08 | Low | review | 2026-07-28 |
| fsssiedx<sssiedx | 2.62 | Low | review | 2026-07-28 |
| fsssiedxc xx psssiedx | 3.14 | Low | review | 2026-07-28 |
| fsssiedxc'sssiedx | 2.68 | Low | review | 2026-07-28 |
| sssieddrubricxsx | 3.16 | Low | review | 2026-07-28 |
| v3.6 | 5.62 | Medium | review | 2026-06-16 |
| v3.4-rev | 3.59 | Low | review | 2026-06-15 |
Bookkeeping
Rubric v3.6
Scored at 2026-06-16 07:47
Listing SHA
90abe5230641…
Force block
— not fired
Score recovered
no
Elapsed
25.0s