Is All-in-One Cambridge Dictionary safe?
We analyzed All-in-One Cambridge Dictionary version 1.1.0's actual code and gave it a 76/100 trust score. The extension appears purpose-aligned, but its…
Bottom line
The extension appears purpose-aligned, but its all-website access and stored-history display weakness warrant caution.
What it can access
It runs on every website and reads selected text for dictionary lookups, which fits the feature but is broader than a single-site tool.[Q1][Q2]
Security weaknesses
Stored lookup terms are inserted into the popup without safe escaping, creating a possible markup-injection weakness.[Q3]
Signs of misuse
No evidence shows tracking, credential collection, unauthorized actions, remote commands, or hidden resource use.[Q7][Q8][Q14][Q23]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects a page access on all webpages and can read user-selected text, while requesting storage, context-menu, and display information.
Declares an all-URLs content script and contextMenus, storage, and system.display permissions. — manifest.json:1-3
Which websites can it run on, and can it read or change what appears on those pages?
It reads the current text selection and adds a small lookup icon; it does not otherwise scan page content.
Creates the icon, reads window.getSelection after mouseup, and returns selection only for lookup actions. — content.js:20-60,96-160
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Stored lookup terms are rendered with unescaped innerHTML in the extension popup, allowing markup injection; active script execution was not demonstrated.
Interpolates each stored history item into an li and unquoted data-value attribute via innerHTML. — index.js:9-14
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores the selected dictionary, last 20 lookup terms, icon preference, auto-close preference, and popup dimensions locally.
Maintains local dictionary selection and bounded lookup history. — background.js:77-95,121-153
Stores and restores display preferences locally. — options.js:2-46
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests none of those permissions. — manifest.json:1-3
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The requested lookup term is sent only to Cambridge Dictionary by opening a fixed Cambridge URL; no other page data is transmitted.
Builds a dictionary.cambridge.org path from the selected dictionary and requested term and opens it in a popup window. — background.js:22-75
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All behavior and dictionary choices are packaged or stored locally. — background.js:1-226
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Selection is only used when the user activates the lookup icon. — content.js:41-60,96-145
Other lookup paths are explicit context-menu and keyboard commands. — background.js:156-166,202-225
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings permissions. — manifest.json:1-3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive names and straightforward event handlers. — background.js:1-226
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses static DOM creation and event handlers only. — content.js:1-160
Uses fixed packaged logic and browser APIs only. — background.js:1-226
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses the active tab id solely for getSelection messaging. — background.js:202-225
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores lookup history and preferences without creating identifiers. — background.js:1-226
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission and no host access. — manifest.json:1-3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Responds only to the lookup-selection extension command and requests selected text. — background.js:202-225
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable origins or remote instruction path. — manifest.json:1-3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates a fixed-styled icon and adds it to document.body. — content.js:20-94
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Creates a popup window for the fixed Cambridge origin without network interception. — background.js:22-75
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or localhost access. — manifest.json:1-3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote behavior is limited to opening requested Cambridge result pages. — background.js:1-226
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable interface. — manifest.json:1-3
Runtime listener returns selected text only to extension senders. — content.js:153-160
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Auto-close uses a user preference; lookups use explicit commands. — background.js:176-190,202-225
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Behavior is limited to lookup navigation, history, options, and popup window management. — background.js:1-226
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Only reads selection and inserts its own icon; it does not query or edit forms. — content.js:20-160