Is FB Messenger™ Translator - Immersive Translation safe?
We analyzed FB Messenger™ Translator - Immersive Translation version 1.7.1's actual code and gave it a 52/100 trust score. This is a site-limited…
Bottom line
This is a site-limited translator with substantial privacy exposure and a meaningful page-control weakness.
What it can access
It runs only on Facebook and Messenger but reads private messages and optional drafts and sends data to translation and analytics services.[Q1][Q3][Q6][Q13]
Security weaknesses
Untrusted page messages can trigger draft replacement or sending, while vendor settings choose what the extension reads or edits.[Q16][Q21][Q24]
Signs of misuse
It sends message text to translation providers and user details to analytics, and logs login credentials locally; no attacker-directed transfer is shown.[Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs three page access on Facebook and Messenger, can read/edit those pages, stores data locally, and can inspect tab URLs. It is not installed on unrelated sites.
Limits content scripts to facebook.com and messenger.com and requests storage and tabs. — manifest.json:2
Which websites can it run on, and can it read or change what appears on those pages?
It locates received-message containers, reads their text, inserts translations, and locates the current draft box using configured selectors.
Observes received-message elements, extracts text, requests translations, and inserts translated spans. — Translator.7f0b6bc1.js:1
Locates and observes the configured contenteditable draft element. — InputTranslator.c7546567.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads private Messenger message text and can read the text being drafted when preview is enabled. This is central to the translation feature.
Collects received-message text for batch translation. — Translator.7f0b6bc1.js:1
Extracts draft text and submits it for translation when preview is active. — InputTranslator.c7546567.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores translation settings, up to 200 original/translated message pairs, usage counts, vendor configuration, and login sessions locally. It does not request cookies or browser history.
Caches original and translated text in TranslationCachesV2 and persists Supabase auth through extension storage. — static/background/index.js:1-6
Requests storage but not cookies or history. — manifest.json:2
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Creates a DataTransfer containing the generated translation rather than reading clipboard contents. — InputTranslator.c7546567.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Message text is sent to Google, Microsoft, or Yandex for translation. Mixpanel receives analytics events, while Supabase receives account, subscription, and configuration requests.
POSTs text to Google/Microsoft translation services or sends it in a Yandex request. — static/background/index.js:1-6
Initializes Mixpanel, tracks page views and clicks, and uses Supabase account/configuration functions. — Translator.7f0b6bc1.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads vendor configuration from Supabase. That configuration includes selectors controlling which Messenger elements are read and edited; no malicious selector set was observed.
getCustomConfig calls a Supabase RPC and returns server configuration. — static/background/index.js:1
Uses customConfig.reciveMsgInsertContainer and related selectors in the message-processing path. — Translator.7f0b6bc1.js:1
Uses customConfig.inputTextEl to select the draft editor. — InputTranslator.c7546567.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Incoming-message translation is enabled by default. Draft preview and immediate sending are disabled by default, and the main translation switch can stop processing.
Defines TranslationSwitch true, TranslationPreview false, and SendImmediately false defaults. — Translator.7f0b6bc1.js:1
Explains the translation switch, preview, shortcut, and immediate-send controls. — _locales/en/messages.json:28-65
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser override or settings permission. — manifest.json:2
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Application code is minified into large bundles, reducing reviewability, but identifiable React, Plasmo, Supabase, and Mixpanel libraries explain much of the size. Minification alone is not evidence of abuse.
Contains minified application and third-party library modules in a Parcel bundle. — Translator.7f0b6bc1.js:1
Contains minified Plasmo background modules and readable endpoint strings. — static/background/index.js:1-6
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Implements fixed translation, auth, configuration, and tab handlers without text-to-code execution. — static/background/index.js:1-6
Does it track the websites, pages, searches, or links you visit?
Mixpanel page-view telemetry runs on Facebook/Messenger pages and may include standard URL/referrer context. The extension does not request browser history or run on other sites.
Initializes Mixpanel and explicitly tracks Page View from the Facebook/Messenger content script. — Translator.7f0b6bc1.js:1
Restricts content-script matches to Facebook and Messenger. — manifest.json:2
Does it create a persistent ID or browser fingerprint to recognize you?
Mixpanel is initialized with persistent localStorage identity, tracks page views and setting clicks, and identifies signed-in users by ID while setting their name and email. Network delivery is strongly supported but was not runtime-tested.
Calls mixpanel.init, track, identify, and people.set with user ID, name, email, and plan. — Translator.7f0b6bc1.js:1
Includes the same active analytics initialization and click tracking in another page script. — InputTranslator.c7546567.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It stores Supabase login sessions and handles OAuth access/refresh tokens. The sign-in handler logs both tokens to the extension console, a local exposure flaw; no attacker-directed transmission was found.
Extracts OAuth access_token and refresh_token, logs them, and passes them to Supabase setSession. — static/background/index.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
When translation preview is enabled, a MutationObserver monitors draft changes and sends the draft for translation. This option is off by default and visibly described.
Observes the configured contenteditable element and translates its current text on mutations. — InputTranslator.c7546567.js:1
Describes real-time translation preview based on input content. — _locales/en/messages.json:36-43
Can a website or remote server send commands that make the extension take actions?
The vendor can change selectors that determine which content is read, where translations are inserted, and which input is edited inside Facebook/Messenger. The control mechanism is confirmed; malicious use is not demonstrated.
Fetches custom configuration from the vendor's Supabase project. — static/background/index.js:1
Uses the returned inputTextEl selector for reading and editing the draft. — InputTranslator.c7546567.js:1
Uses returned receive-message selectors to read and modify message DOM. — Translator.7f0b6bc1.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Appends translated spans beside or instead of received message text. — Translator.7f0b6bc1.js:1
Dispatches a paste event containing translated text to the selected input. — InputTranslator.c7546567.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:2
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:2
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Retrieves configuration through get_project_config_v2_by_id. — static/background/index.js:1
Consumes that configuration as DOM selectors rather than executable code. — Translator.7f0b6bc1.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
The input translator accepts any window message whose data.action is translateInput without checking event source or origin. That bridge reaches draft replacement and, when enabled, simulated sending.
Registers an unchecked window message listener, pastes translated text, and conditionally dispatches Enter. — InputTranslator.c7546567.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Local settings control automatic incoming translation, live draft monitoring, provider choice, and immediate sending. Vendor configuration also controls the page selectors used by those behaviors.
Defines and consumes translation, preview, provider, and immediate-send settings. — Translator.7f0b6bc1.js:1
Activates draft observation and sending only under the relevant settings and server configuration. — InputTranslator.c7546567.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains translation, account, cache, configuration, and tab modules. — static/background/index.js:1-6
Does it change form fields or where a form sends its information?
It can replace the Facebook/Messenger draft and optionally simulate Enter to send it. Normal use requires the translation shortcut, but the unchecked page-message listener lets any frame request the same action when the feature is active.
Focuses the configured input, selects all, pastes translated text, and conditionally dispatches an Enter key event after any translateInput window message. — InputTranslator.c7546567.js:1