Is AI Language Learning, Translation, Word Marking - NeonLingo safe?
We analyzed AI Language Learning, Translation, Word Marking - NeonLingo version 2.6.3's actual code and gave it a 18/100 trust score. NeonLingo provides…
Bottom line
NeonLingo provides useful translation features but has dangerously broad website access and an unrestricted bridge that can expose account data.
What it can access
It reads and changes pages across all websites, sends selected text and page URLs to its services, and exposes account data through a broad bridge.[Q1][Q2][Q6][Q14]
Security weaknesses
Any webpage can invoke privileged functions, access stored account data, and request unrestricted network fetches without a trusted-site check.[Q16][Q18][Q21]
Signs of misuse
The extension actively tracks visited-page addresses and exposes account data and powerful actions to ordinary websites, creating serious misuse potential.[Q12][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects page access into all URLs and frames, including fallback/about:blank frames. File-page access still depends on the browser's separate allow-file-URLs setting.
Declares all-URL content scripts at document_start and document_end, plus a file:// content script. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
It walks page page text and selections to highlight, translate or replace words and passages. This access is necessary for the advertised feature.
Uses TreeWalker and MutationObserver to discover text, reads selections and builds translation requests from page text. — content-scripts/neonlingo.js:67,73,80
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Normal marking rules exclude input, textarea, select and contenteditable subtrees. — content-scripts/neonlingo.js:67,73
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads active-tab and current-page URLs for page context. It does not request Chrome history, bookmarks, cookies or downloads databases.
Requests tabs but not history, bookmarks, cookies or downloads. — manifest.json:3
Queries the active tab URL when browser context is needed. — background.js:26
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
User-clicked controls can copy or download a generated NeonLingo progress card. No camera, microphone, location, general screenshot or native-device access was found.
Renders the extension's own progress-card element, then copies its image or downloads it only from explicit UI handlers. — content-scripts/neonlingo.js:77-80
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Text selected for translation is sent to NeonLingo, Google Translate or Microsoft Translator. NeonLingo also receives feature telemetry with page URLs; these destinations support the advertised service but disclose browsing context.
Defines api.neonlingo.com and posts translation text to Google or Microsoft translation endpoints depending on settings. — background.js:9,61
Queues product events with window.location.href and sends selected text into translation RPCs. — content-scripts/neonlingo.js:66-67
Does it download or run code, settings, or instructions supplied by a remote server?
NeonLingo supplies supported engines, account state and translation or immersion results. These affect behavior and page text, but no remote executable code was found.
Periodically refreshes supports/account data and requests translation or language-immersion output from the service. — background.js:61,68
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Page scanning, bridge setup, URL observation and scheduled account/support refreshes start automatically. Automatic translation depends on saved settings and can be disabled globally or per site.
Loads the all-sites bootstrap and page scanner automatically. — manifest.json:3
Creates periodic user, notification, supports and prompt jobs. — background.js:68
Checks the disabled flag, site blacklist and auto-translation settings before feature actions. — content-scripts/neonlingo.js:67,80
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings, proxy, privacy or management permission. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application is heavily bundled and minified, which makes review harder, but services names, storage keys and privileged routes remain readable. No encrypted code data was found.
Large minified bundle retains readable API routes, storage keys and bridge names. — background.js:1-68
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
ArkType-related packaged code compiles validators and performs fixed Function feature detection. — background.js:30-33
Bundled libraries contain fixed Function expressions and schema compilation; no remote source-to-sink path was found. — content-scripts/neonlingo.js:22,33-36
Does it track the websites, pages, searches, or links you visit?
It reads the full current URL for site rules, translation context and telemetry. Product-event calls can send that URL to NeonLingo, so visited-page disclosure is active when those events occur.
Telemetry uses window.location.href, and language-immersion requests include the owner document's URL. — content-scripts/neonlingo.js:66-67,73
Stores queued tracking records with their URL and passes page URL into language-immersion requests. — background.js:59,61
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent device ID and combines it with event names, properties, page URLs and an account ID when signed in. This is product analytics, not demonstrated covert resale or unrelated advertising.
Persists local:deviceId and builds queued events containing anonymousId, userId, properties and url. — background.js:26,59
Does it send cookies, session details, authentication data, or page contents elsewhere?
NeonLingo access and refresh tokens are stored locally. The all-sites bridge exposes that storage to any webpage; no browser-cookie access was found.
Stores token and refreshToken under local:authToken and uses them for NeonLingo authentication. — background.js:9,26
Exports every storage key, including authToken, through the privileged RPC router. — background.js:68
Makes that router reachable from any webpage through a transferable MessagePort. — content-scripts/bootstrap.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Exclusion selectors cover form/editable controls, and selection-trigger logic checks trusted pointer events. — content-scripts/neonlingo.js:67,80
Can a website or remote server send commands that make the extension take actions?
Any webpage can invoke the extension's privileged background services and storage methods. This is active in the package and requires no future server data, although malicious exploitation was not observed.
Accepts connect messages on every site and forwards an attached MessagePort to chrome.runtime.connect. — content-scripts/bootstrap.js:1
Upgrades the named port to a router containing account, translation, settings, tracking and raw storage operations without checking sender origin. — background.js:68
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates marker elements and translated wrappers, replaces text nodes and maintains them with mutation observers. — content-scripts/neonlingo.js:67,73
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
Any webpage can open the file bridge with an arbitrary URL; the background fetches it and streams response bytes back. No URL allowlist or trusted-origin check is applied.
Maps any valid file-connect page message to the neonlingo:extension-file:v1 runtime port. — content-scripts/bootstrap.js:1
Validates only message shape, then calls fetch(request.url) and returns the response stream; no scheme, host or origin restriction appears. — background.js:68
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or system-level permission. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Dynamic constructors belong to packaged validation code, while remote responses flow into translation/configuration data paths. — background.js:30-33,61
Declares only packaged scripts and no remotely hosted script source. — manifest.json:3
Can ordinary websites access privileged extension features through messaging or exposed files?
The page-to-extension bridge is unrestricted across all sites. It checks that a message came from the current window/origin, but the current page is the potential attacker and chooses its own token; the background performs no sender allowlist check.
Runs on all sites, accepts page-chosen string tokens, and opens privileged API/file ports for same-window messages. — content-scripts/bootstrap.js:1
Routes privileged ports by name without validating sender.tab.url or restricting the calling origin. — background.js:68
Injects the bridge into all URLs and all frames. — manifest.json:3
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads disabled, blacklist, engine and automatic-translation settings before scanning or rewriting pages. — content-scripts/neonlingo.js:67,73,80
Exports get/set/remove operations for all settings and storage records to the bridge. — background.js:68
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Scheduled work refreshes account, notification, support and prompt data; no mining endpoint or algorithm appears. — background.js:68
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Traversal exclusion selectors cover form and editable controls; no application sink changes action attributes or reads their values. — content-scripts/neonlingo.js:67,73