Is Relingo - Master vocabulary while browsing websites and watching YouTube safe?
We analyzed Relingo - Master vocabulary while browsing websites and watching YouTube version 3.30.1's actual code and gave it a 55/100 trust score.…
Bottom line
Relingo provides useful translation features, but its broad page access, data sharing, cookie capability, and local-software communication create meaningful privacy and security concerns.
What it can access
The extension can read and change pages on nearly all websites and local files, read cookies, communicate with local software, and open or close tabs. [Q2] [Q4] [Q19] These powers support translation and subtitles but are substantially broader than a narrowly site-scoped learning tool.
Signs of misuse
It sends page text, saved page HTML, captions, URLs, and usage information to Relingo, service providers, and a tracking service when features run. [Q6] [Q12] This is privacy-invasive and not fully transparent, but the evidence does not establish cookie theft, deceptive manipulation, mining, or code
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests broad page access across websites and local files, cookie access, and communication with local software; this supports translation and subtitles but is broader and more powerful than the core feature requires.
The extension declares storage, cookies, and contextMenus permissions; access to Relingo servers and local addresses; and content scripts on all HTTP, HTTPS, and file pages, plus supported video and learning sites. — manifest.json:1
The service worker reads cookies using caller-supplied values, communicates with a native messaging host, makes local requests, and can create or close browser tabs and windows. — build/background.js:14
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.relingo.net/, http://localhost/*, http://127.0.0.1/*, *://*.localhost/* — manifest.json:1
Content scripts run directly on: http://*/*, https://*/*, file://*/*, https://youtube.com/*, https://m.youtube.com/*, https://www.youtube.com/*, https://netflix.com/*, https://www.netflix.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The content script runs in all frames on HTTP, HTTPS, and file pages and can read page text and selected input values for translation and processing. This makes messages or form entries reachable, although the reviewed code does not establish password logging or transmission of every field.
build/content.js runs at document_end on all HTTP, HTTPS, and file URLs, including all frames. — manifest.json:48-89
Page-processing initialization and translation flows read and process document-derived content, including input-related content. — build/content.js:43299-43311
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension has the cookies permission and a service-worker handler that reads a cookie using a caller-supplied URL and name. Observed normal use requests a Relingo cookie, but the handler has broader cookie-read capability than that single call site.
The extension declares the cookies permission. — manifest.json:10-14
The getCookie handler calls chrome.cookies.get with message-supplied name and URL. — build/background.js:14
A normal login-related caller requests the Relingo referrer cookie. — build/content.js:35
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends page text, captions, selected words, saved-page HTML, lookup data, and usage metadata to Relingo, configured translation providers, dictionary/audio services, and telemetry infrastructure. The package does not establish how those services retain or further share the data.
Read-later sends the current URL, title, and document.body.innerHTML to saveContent. — build/content.js:1458-1459
Translation, subtitle, dictionary, and related flows send page- or media-derived text to external services. — build/content.js:1459,43310-43311
Telemetry posts URL and event metadata to https://trk.lesslab.net/api/send. — build/content.js:35
The service worker brokers authenticated API requests and caller-selected endpoints. — build/background.js:2,14
Does it download or run code, settings, or instructions supplied by a remote server?
The service worker accepts caller-supplied request endpoints and the extension consumes remote API responses, but the reviewed package does not establish that remote responses are executed as extension code or settings. Large partial bundles and unresolved request paths leave this behavior incompletely verified.
fetch and request handlers accept caller-supplied URL, endpoint, function, headers, and data values. — build/background.js:14
Translation providers and custom endpoints consume remote responses. — build/content.js:1459
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The service worker can open and close tabs or windows using message-derived values, and lifecycle events automatically open onboarding or changelog pages. Some actions require user interaction, but installation and update behavior does not require a contemporaneous page-level request.
Handlers invoke tab and window creation/removal APIs with message-derived arguments. — build/background.js:14
Installation and upgrade handlers open Relingo pages; context-menu handling opens the PDF viewer. — build/background.js:14
Commands and the toolbar action provide additional extension-triggered entry points. — manifest.json:18-46
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because core runtime files are multi-megabyte generated/minified bundles, and some bundled dependencies are only partially covered. The package also depends on an external native host and remote services whose behavior is not included.
The 2.6 MB service-worker bundle compresses registrations and handlers into difficult-to-separate generated code. — build/background.js:2,14
The 2.9 MB generated content bundle contains numerous bundled providers and feature branches. — build/content.js:1-43311
The injected main-world bundle contains bundled adapter and network-hook logic. — build/video_listeners.js:27,39-44
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The bundled PDF.js code contains eval and new Function constructions, including glyph-compilation paths. This is library behavior used by the PDF viewer rather than evidence that arbitrary server text is intentionally treated as extension code.
The bundled PDF library contains eval('require')(this.workerSrc). — vendor/pdf.min.js:2036
The PDF library uses new Function, including compiled glyph code. — vendor/pdf.min.js:547,5428
The PDF worker also contains new Function constructions. — vendor/pdf.worker.js:1147,57505
Does it track the websites, pages, searches, or links you visit?
Telemetry records browsing and feature activity, including page URLs or hostnames, video locations, word actions, and TTS events. It sends that information to a separate tracking endpoint, with an optional account-derived identifier.
The telemetry payload includes hostname, truncated URL, event name, version, optional UID, and event data. — build/content.js:35
Video initialization records a video_opened event with location.href. — build/content.js:43310
TTS and vocabulary actions invoke tracking paths. — build/content.js:1638-1649
Does it create a persistent ID or browser fingerprint to recognize you?
No browser fingerprinting or persistent device ID was demonstrated. The extension does persist account and application state, but that is not evidence of fingerprint-based recognition.
Persists relingo-v2 configuration, account, and application data in extension storage. — build/content.js:12,31
Telemetry may include a hashed account identifier when available, not a demonstrated browser fingerprint. — build/content.js:35
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends page contents and selected media/text data to Relingo and configured providers, including complete page HTML in the read-later feature. The reviewed code does not establish that arbitrary website session cookies are copied to third parties, but page-content transmission is established.
Read-later serializes URL, title, and document.body.innerHTML and sends it to saveContent. — build/content.js:1458-1459
Translation and subtitle paths send page paragraphs, selected text, and captions externally. — build/content.js:1459,43310-43311
The worker performs authenticated API requests and brokers external requests. — build/background.js:2,14
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence showed recording keystrokes, form entries, clipboard contents, or screenshots. The extension does read page text and selected text for translation and pronunciation, which is different from recording typing or clipboard data.
Processes visible document text and media content. — build/content.js:43296-43311
TTS uses selected or clicked text for pronunciation. — build/content.js:1638
Can a website or remote server send commands that make the extension take actions?
Authorized Relingo pages can send external messages and retrieve the stored account object, but the reviewed code does not prove that an external website can invoke arbitrary tab, cookie, or network commands. Because the service-worker handler inventory is incomplete, broader commandability remains unresolved.
External messaging is allowed only for pages matching *://*.relingo.net/*. — manifest.json:91-95
onMessageExternal handles getAccount and returns stored account data to an authorized sender. — build/background.js:14
Other privileged runtime handlers exist, but their external-message reachability and authorization were not completely traced. — build/background.js:14
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence showed affiliate manipulation, ad injection, shopping-cart changes, referral-code rewriting, or search-result alteration. The extension mainly highlights, translates, and adds learning UI.
Highlight logic replaces page text nodes with Relingo elements for vocabulary learning. — build/content.js:43296-43299
Context-menu actions drive translation, lookup, read-later, and PDF viewing rather than advertising or shopping manipulation. — build/background.js:14
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No traffic interception, header modification, download interception, or proxy-setting behavior was demonstrated. The extension does make its own requests and observes selected streaming-site XHR/fetch responses.
Hooks page-level XMLHttpRequest and fetch to observe supported media responses. — build/video_listeners.js:39-44
Performs API requests through a broker, but no webRequest, proxy, or download interception was identified. — build/background.js:2,14
Can it communicate with software on the computer or services running on localhost?
The service worker communicates with a native messaging host named application.id and can also use localhost-related endpoints. The native host implementation is outside the package, so its privileges and handling of returned account data cannot be assessed.
getNativeAccount calls chrome.runtime.sendNativeMessage with application.id. — build/background.js:14
Host permissions include localhost, 127.0.0.1, and localhost subdomains. — manifest.json:14-16
The request client supports a local/debug endpoint and a generic caller-supplied fetch URL. — build/background.js:2,14
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension parses structured video, subtitle, PDF, and provider responses and injects some resulting HTML into page or extension UI. The reviewed paths do not establish that hidden or encrypted data is decoded and then executed as code, and complete sanitization coverage is unresolved.
The injected bundle observes and parses XHR/fetch responses for video and subtitle metadata. — build/video_listeners.js:39-44
Provider and translation results reach dangerouslySetInnerHTML rendering paths. — build/content.js:17509,17528,22895,33790
Highlight, annotation, caption, and notice markup is generated and inserted into DOM. — build/content.js:43296-43306
Can ordinary websites access privileged extension features through messaging or exposed files?
Pages on Relingo subdomains can use the external messaging feature to request the stored account object. Arbitrary websites can load web-accessible extension resources, but loading a resource alone does not grant privileged extension APIs or messaging access.
External messaging is restricted to Relingo subdomains, while all packaged resources are declared web-accessible to web pages. — manifest.json:91-109
The getAccount external handler reads persist:relingo-v2 and returns the stored account object. — build/background.js:14
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Some behavior is conditional on websites, configuration, CSP, account state, and user actions. No evidence showed a hidden date-based or server-controlled activation switch, but remote configuration and API responses influence behavior.
Content scripts activate on broad web/file URLs, with additional document-start behavior on selected video sites. — manifest.json:48-89,111-140
Processing responds to configuration, navigation, DOM changes, visibility, and supported-site conditions. — build/content.js:43299-43311
Configured translation engines and video adapters determine external processing and telemetry. — build/content.js:1459,43310-43311
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining or comparable hidden resource-intensive workload was demonstrated. Work observed is translation, parsing, subtitle handling, rendering, and media integration.
Initialization processes page text, mutations, visibility, translations, and captions. — build/content.js:43299-43311
Media work consists of observing and parsing supported-site network responses. — build/video_listeners.js:39-44
Does it change form fields or where a form sends its information?
The extension changes page DOM content and processes input-related text for translation, but the reviewed evidence does not conclusively show that it writes form values or changes a form submission destination. Additional site-specific and bundled paths remain insufficiently isolated to make a clean negative.
The all-frame content script can access DOMs on HTTP, HTTPS, and file pages. — manifest.json:48-89
Highlighting replaces text nodes and injects learning elements, demonstrating page modification but not form submission rewriting. — build/content.js:43296-43299
Translation and full-text processing derive content from pages and captions; a definite form-action sink was not established. — build/content.js:1459,43310-43311