Is TransParrot: YouTube Translate & Dual Subtitles safe?
We analyzed TransParrot: YouTube Translate & Dual Subtitles version 1.3.3's actual code and gave it a 68/100 trust score. This is a purpose-aligned…
Bottom line
This is a purpose-aligned YouTube translator, but it collects YouTube page and usage information and contains a potentially misuse-prone message path.
What it can access
The manifest grants page access on YouTube and communication with Google and TransParrot-related services, which supports translation, subtitles, audio, and sign-in. [Q2] It also sends YouTube page details and usage information for analytics, making access broader than the visible subtitle feature.َ
Security weaknesses
Service-worker message handlers do not visibly verify who sent requests, so a reachable page-to-extension path could potentially trigger selected actions; that full path is not proven. [Q16] Large one-line bundles also make important behavior difficult to inspect. [Q10]
Signs of misuse
The extension definitely sends YouTube page URLs, titles, usage events, and an analytics client ID to Google Analytics. [Q6] This is unexplained tracking beyond the core subtitle display and is stronger evidence of privacy-impacting behavior than a permission alone. [Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests access to YouTube pages plus several Google and TransParrot service domains. This fits subtitle translation, audio, and sign-in features, but also permits page-related analytics and broader service communication than subtitles alone require.
The manifest declares storage and network-request permissions, with access covering YouTube, Google Analytics, Google Tag Manager, and youtubetranslate.net. — manifest.json:1
Content scripts run on YouTube pages, where they can inspect and modify page content for subtitle features. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.youtube.com/*, *://*.googletagmanager.com/*, *://*.google-analytics.com/*, *://*.youtubetranslate.net/* — manifest.json:1
Content scripts run directly on: *://*.youtube.com/*, *://*.youtube.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension runs a large content-script bundle on YouTube pages, but the supplied source is largely minified and cannot establish complete coverage of all input handling. The inspected track code handles subtitle metadata, not passwords, payment details, messages, or form entries.
The 867 KB content script is a single generated line, so complete tracing of DOM-input reads and uses is not reliable. — content.js:1
Reads YouTube caption-track information and language metadata; no sensitive form value is established here. — page_script_get_track.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence was found that it reads cookies, browsing history, bookmarks, downloads, or browser sessions. It does use extension storage and handles its own authentication token flow.
Declared permissions are storage and declarative network-request permissions; cookies, history, bookmarks, and downloads are not declared. — manifest.json:9-13
Uses chrome.storage and stores captured subtitle URLs, but no cookie/history/bookmark/download API access is shown. — background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends usage and page information to Google Analytics, including a client identifier, event parameters, and YouTube page title and URL. It also sends audio requests through the extension service worker and contains application-service requests, although the complete payload inventory is limited by bundling.
The ANALYTICS_EVENT handler posts client_id, event name, parameters, and optional user_id to google-analytics.com Measurement Protocol. — background.js:1
The fetch_audio handler fetches a caller-supplied URL in the service worker and returns the downloaded bytes to the caller. — background.js:1
The bundle contains page-view analytics fields including page_title and page_location. — content.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads text from a remote source and executes it as code. This lets that source change the extension's behavior without a store update.
Webpack runtime contains new Function("return this")(). — background.js:1
The page-script bundle contains the same webpack runtime fallback. — page-script.js:1
The track-script bundle also contains the webpack runtime fallback. — page_script_get_track.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension performs actions automatically while YouTube pages are used, including intercepting subtitle requests, sending analytics, fetching audio, and notifying content scripts after page loads. These actions do not each require a new user click.
Automatically handles analytics, audio-fetch requests, installation/startup events, storage changes, and completed YouTube tabs. — background.js:1
Hooks page fetch/XMLHttpRequest behavior to detect YouTube timed-text activity. — page-script.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the main content and background scripts are very large generated bundles presented on one line. This is an auditability limitation, not by itself evidence of malicious behavior.
The 867,783-byte content script is a single generated/minified line. — content.js:1
The service worker is bundled into one generated line with embedded runtime and application logic. — background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The bundled webpack runtime calls new Function("return this")() to obtain a global object. The verified use is a runtime compatibility fallback, not execution of text downloaded from a server.
Webpack runtime contains new Function("return this")(). — background.js:1
The page-script bundle contains the same webpack runtime fallback. — page-script.js:1
The track-script bundle also contains the webpack runtime fallback. — page_script_get_track.js:1
Does it track the websites, pages, searches, or links you visit?
It records YouTube page visits and usage analytics by sending the current page URL, title, client identifier, and event data to Google Analytics. The observed subtitle URL and video ID are also retained in service-worker memory for a limited period.
The bundle includes page-view parameters page_location and page_title. — content.js:1
Analytics events are forwarded to Google Analytics, and subtitle URLs are stored by video ID with timestamps. — background.js:1
Intercepts YouTube timed-text requests and extracts subtitle URL/video identifiers. — page-script.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
The extension stores an analytics client ID and may send it to Google Analytics, but the available bundled code is minified and does not fully show how the ID is generated or whether it is stable.
Analytics requests include a client_id; uninstall reporting falls back to a timestamp-based ID. — background.js:1
Analytics code uses CLIENT_ID, USER_ID, and stored analytics data, but the minified implementation is difficult to trace completely. — content.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The verified code sends analytics and fetches audio, but it does not show cookies, authentication tokens, or arbitrary page contents being copied to an outside destination. The large application bundle contains authentication and service code that was not fully traceable, so complete exclusion is not possible.
Analytics payloads and caller-supplied audio URLs are sent or fetched; no cookie-reading or cookie-forwarding operation is shown. — background.js:1
The bundle contains application/authentication-related code, but its one-line generated form prevents complete source-to-sink tracing. — content.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence was found that it records typing, form entries, clipboard contents, or screenshots. Clipboard access is used only to copy displayed subtitles after a user action.
navigator.clipboard.writeText is used to copy subtitle text, not to read clipboard contents. — content.js:1
Can a website or remote server send commands that make the extension take actions?
A YouTube page can inject messages into the MAIN-world bridge, and the service worker accepts several message actions without checking sender origin. However, the supplied code does not fully establish that page-controlled data reaches every privileged handler, so arbitrary website command execution remains unproven.
The bridge accepts same-window subtitle response events and relays extension events through window.postMessage with a wildcard target. — bridge.js:2-14
Message handlers accept ANALYTICS_EVENT, save_subtitle_url, get_subtitle_url, and fetch_audio without an explicit sender/origin validation check. — background.js:1
The bridge is injected only on matched YouTube pages, not all ordinary websites. — manifest.json:28-58
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence was found that it changes links, referral codes, advertisements, shopping carts, or search results.
The only network rule changes a response CORS header for YouTube timed-text requests. — rules.json:1-17
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It modifies response headers for YouTube subtitle requests and uses a background fetch to retrieve audio. No evidence was found of proxy-setting changes or download interception.
Sets access-control-allow-origin to * for YouTube timedtext XMLHttpRequests. — rules.json:5-15
The fetch_audio message causes the service worker to fetch a supplied audio URL and return its bytes. — background.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence was found that it communicates with native computer software or localhost services.
No native-messaging permission or localhost host permission is declared. — manifest.json:1-63
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
It decodes base64 audio data and turns it into a Blob for playback. This is media handling rather than evidence of executing hidden code or injecting decoded scripts.
Decodes base64 with atob, creates a Blob, and plays it as audio. — page-script.js:1
Converts fetched audio bytes to base64 before returning them to the page. — background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites cannot use the exposed resources merely because they are web-accessible: the manifest limits those resources and the bridge to YouTube URL patterns. YouTube pages do have a restricted subtitle-related bridge, but no general privileged API exposure to arbitrary websites is established.
The MAIN-world bridge and web-accessible resources are matched to *.youtube.com/*. — manifest.json:28-58
The bridge handles specific subtitle response events and page communication, rather than exposing a general extension API. — bridge.js:2-14
Service-worker handlers lack sender checks, but runtime message reachability from an ordinary webpage is not shown. — background.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Some behavior is conditional on user settings, installation state, YouTube pages, and authentication state. I found no evidence of date-based or remote feature flags beyond ordinary service/authentication behavior.
Analytics and storage behavior depends on installation, startup, suspend, and stored settings. — background.js:1
Content scripts run only on YouTube URLs. — manifest.json:20-27
Bundled logic checks login/authentication and translation settings before performing features. — content.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence was found of cryptocurrency mining or other concealed resource-intensive computation. Audio decoding, subtitle processing, and speech playback appear related to the advertised features.
The periodic timer only removes expired captured subtitle URLs. — background.js:1
Does it change form fields or where a form sends its information?
No evidence was found that it changes form fields or form destinations. Its visible interaction is with YouTube subtitles, settings, authentication, and audio playback.
Page-world hooks concern YouTube timed-text requests and audio playback, not forms. — page-script.js:1