Is Arabic Dictionary safe?
We analyzed Arabic Dictionary version 2.0's actual code and gave it a 55/100 trust score. Useful dictionary features are paired with broad page access,…
Bottom line
Useful dictionary features are paired with broad page access, accidental text sharing, and a real page-injection weakness.
What it can access
It runs in every website frame, reads nearby Arabic text, and sends selected text to Google for translation or speech [Q1][Q3][Q6].
Security weaknesses
Returned translation data is inserted into pages without safe handling, and the advertised off switch does not stop activity [Q8][Q20].
Signs of misuse
There is no evidence of tracking, credential theft, deceptive changes, or unrelated collection; Google receives text only when translation or speech is used [Q6][Q14][Q12].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects JavaScript and CSS into every URL and every frame and exposes translator, tooltip, dictionary data, and selection CSS resources to every site. No named Chrome permissions or host_permissions are declared, which leaves its PDF interception code unauthorized rather than reducing content-script reach.
Declares <all_urls> all-frames content injection and globally web-accessible translation/data resources, with an empty permissions list. — manifest.json:1-42
Which websites can it run on, and can it read or change what appears on those pages?
It reads text nodes under the pointer, replaces the user's selection with the Arabic word or sentence, changes selection color, highlights elements, and appends/repositions an extension tooltip. It does not generally rewrite page text or forms.
Mouse handlers walk text nodes, create ranges, alter selection/CSS, and call the tooltip renderer. — contentscript.js:18-264
Appends and positions a tooltip in the page DOM. — tooltip.js:1-100
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read private Arabic text from any page or same-frame document under the pointer, and S expands the range to the surrounding sentence. That can include messages, documents, account information, or other sensitive content.
Locates hovered text, selects Arabic words, and expands to sentence punctuation boundaries. — contentscript.js:89-264
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It implicitly sees the current document and checks PDF/EPUB request URLs in background code, but it does not collect page URLs, enumerate tabs for tracking, read history, bookmarks, downloads, or cookies. The popup queries tabs only to broadcast its toggle message.
Examines request URLs for attempted PDF/EPUB routing. — background.js:1-108
Queries tabs to send toggleExtension, without retaining tab metadata. — popup.js:1-17
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
V requests spoken audio for selected Arabic text and plays it through Web Audio. Local PDF/EPUB viewers can read a user-selected or routed file.
Fetches TTS audio, decodes it with AudioContext, and plays it. — contentscript.js:265-299
Reads a user-selected or URL-supplied EPUB Blob with FileReader. — epub.js/viewer/epubInput.js:1-40
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Pressing S sends the selected surrounding sentence to translate.googleapis.com; pressing V sends selected text as the q URL parameter to translate.googleapis.com/translate_tts. These requests go to Google, not the extension developer, and ordinary single-word definitions stay local.
Sends the supplied Arabic sentence to Google's translation endpoint. — translator.js:395-419
Sends current selection in a TTS GET query and downloads audio. — contentscript.js:265-299
Does it download or run code, settings, or instructions supplied by a remote server?
Google returns translated text or audio that packaged code displays/decodes. The package does not download JavaScript or remote feature instructions, but PDF files can supply document JavaScript that the packaged PDF.js QuickJS sandbox intentionally evaluates.
Parses fixed Google JSON response fields as translated text. — translator.js:395-419
Creates and communicates with the packaged PDF JavaScript sandbox. — pdf.js/web/viewer.js:7077-7413,13397-13412
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On every page/frame it automatically loads all dictionary tables and registers mouse/key listeners. Translation/TTS requires S or V while a word range exists, but the popup toggle merely changes isEnabled and no handler checks that flag, so the advertised off state does not stop behavior.
initialize runs automatically; keyup handlers send/voice text without consulting isEnabled. — contentscript.js:1-25,214-299
Broadcasts toggleExtension even though the receiver's state is unused. — popup.js:1-17
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-setting, proxy, management, downloads, or declarativeNetRequest permissions. — manifest.json:1-42
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party code is readable, but the 58.8 MB unpacked package includes two PDF.js generations, complete source maps, EPUB.js, a 22 MB morphology database, and multiple megabytes of dictionary tables. This oversized, partly unrelated dependency surface makes review and maintenance harder.
Records duplicate PDF stacks, EPUB.js, source maps, and large dictionary databases. — inventory.json:complete file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
PDF.js contains explicit new Function paths for capability tests and compiled PDF glyph/image operations, and its packaged QuickJS sandbox evaluates JavaScript embedded in PDF documents. These are document-rendering/sandbox mechanisms rather than remote server code; extension CSP can disable main-realm Function compilation, while the QuickJS sandbox is intentionally isolated.
Tests new Function support and conditionally compiles glyph drawing code. — pdf.js/build/pdf.js:558-571,4950-5023
QuickJS sandbox initializes globalEval and evaluates PDF actions/timer expressions. — pdf.js/build/pdf.sandbox.js:228
Enables PDF scripting and loads the packaged sandbox bundle. — pdf.js/web/viewer.js:3042-3206,7077-7413
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Contains no URL log, navigation tracking, or storage. — contentscript.js:1-299
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
No identifier generation or telemetry path. — contentscript.js, translator.js, background.js:complete files
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies, identity, or webRequest authorization. — manifest.json:1-42
Translation fetch carries only fixed parameters and selected text. — translator.js:395-419
Does it record typing, form entries, clipboard contents, or screenshots?
It registers a global keyup listener on every page/frame and reacts to the bare S and V keys. It is not a general keylogger and does not store typed text, but those common keys can trigger transmission/playback of the current selected sentence or word.
Global keyup handler calls sentence translation on s and TTS on v. — contentscript.js:214-299
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Runtime listener recognizes only toggleExtension. — contentscript.js:1-25
No externally_connectable declaration. — manifest.json:1-42
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Changes selection/background and invokes tooltip UI. — contentscript.js:22-213
Builds and positions the translation table. — tooltip.js:1-100
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
Background code attempts to intercept all main/sub-frame PDF responses, rewrite Content-Disposition for explicit downloads, and redirect PDFs/local EPUBs into packaged viewers. However, the manifest lacks webRequest, webRequestBlocking, tabs, host, and file-scheme authorization, so these listeners cannot perform that behavior as shipped.
Registers blocking onHeadersReceived/onBeforeRequest listeners and tab redirects. — background.js:1-108
Declares an empty permissions list and no host_permissions. — manifest.json:1-42
Can it communicate with software on the computer or services running on localhost?
It contains code to open local file:// PDF and EPUB files in packaged viewers, conditional on Chrome file-access authorization that is not declared/granted automatically. It uses no localhost service, native messaging, or companion application.
Matches local PDF/EPUB file URLs and attempts viewer redirects. — background.js:80-108
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
Google translation text and packaged dictionary strings are concatenated into tooltip.innerHTML without escaping. A crafted response/data string could inject markup into the page page, although no direct script execution sink is used there.
Builds HTML strings from translation/definition values and assigns innerHTML. — tooltip.js:12-63
Evaluates document-supplied PDF actions in QuickJS. — pdf.js/build/pdf.sandbox.js:228
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Makes translator.js, tooltip.js, data/*, and selection.css web-accessible on every site. — manifest.json:24-41
Only internal chrome.runtime messages are accepted. — contentscript.js:1-25
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines but never consults isEnabled; S/V and hover state control actions. — contentscript.js:1-25,214-299
Routes based on PDF headers and local file extensions. — background.js:1-108
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Fetches, splits, and indexes six packaged dictionary/table files per Translator instance. — translator.js:1-127
Creates a Translator per frame and repeatedly scans DOM ranges under the pointer. — contentscript.js:1-213
Dictionary data totals roughly 26 MB, led by data/aramorph-db and data/dictstems. — inventory.json:complete file
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Handlers manipulate Range/Selection and tooltip state, not forms or input values. — contentscript.js:18-299