Is Translate - Translator, Dictionary, TTS safe?
We analyzed Translate - Translator, Dictionary, TTS version 1.4.11's actual code and gave it a 62/100 trust score. Useful translation features require…
Bottom line
Useful translation features require broad page access and send selected content to several services, creating meaningful privacy and access concerns without clear abuse.
What it can access
It runs on every ordinary website and can read selected text, while translation and OCR data may leave the browser for feature services [Q1][Q3][Q6].
Security weaknesses
Broad page access and automatic selection monitoring could expose sensitive text, but no website-controlled privileged commands or settings changes were found [Q2][Q8][Q16].
Signs of misuse
The extension sends feature-related content to translation services and reports a persistent installation ID, but no unrelated tracking or session-data theft was established [Q6][Q13][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has host and content-script access to every HTTP and HTTPS page, plus tabs, storage, and context-menu permissions.
Declares <all_urls>, tabs, storage, contextMenus, and a content script on all HTTP and HTTPS pages. — manifest.json:14-48
Which websites can it run on, and can it read or change what appears on those pages?
It reads the user's selected page text and adds translation controls to the page.
Reads window or document selections after mouseup and displays small, medium, or full translation UI. — js/contentScript.js:1
Loads the content and translation scripts on all ordinary web pages. — manifest.json:20-48
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Selected or typed text, translation history entries, speech text, and optional OCR image content can be processed by remote services.
Sends translation text, dictionary words, and speech text to Backenster or Google Translate. — js/translate.js:1
Uploads a user-selected screenshot crop for OCR and conditionally syncs bookmarked translations. — js/background.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It locally stores translation history, bookmarks, input text, settings, counters, and an installation identifier.
Reads and writes translateHistory, inputText, language, voice, UI, and usage-count settings. — js/translate.js:1
Creates and stores mtz_uuid and manages local bookmark synchronization state. — js/background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
Its user-invoked OCR feature captures the visible tab, and the popup can copy translated text to the clipboard.
Lets the user select an OCR rectangle and requests a visible-tab screenshot. — frame/Scripts/cs.js:1
Uses chrome.tabs.captureVisibleTab and returns the screenshot to the OCR overlay. — js/background.js:1
Copies translated output through navigator.clipboard when the user clicks Copy. — js/translate.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends feature data to Backenster, Google Translate, and conditionally Lingvanex; these destinations correspond to translation, OCR, speech, dictionary, and sync features.
Calls Backenster translation, webpage, speech, lexical, and sentence endpoints and Google's translation endpoint. — js/translate.js:1
Calls Backenster OCR and Lingvanex favorite-sync endpoints. — js/background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads vendor configuration for limits and notification scheduling, but no executable code is supplied and the notification path appears incomplete.
POSTs to Backenster /api/app/config and reads ShowLocalNotification, LocalNotificationFireTime, and localNotification values. — js/background.js:1
Requests the same config and reads translation, speech, advertising-rotation, and rating thresholds. — js/translate.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically watches selections and injects UI on every site; automatic translation is off by default and can be enabled separately for words or short sentences.
Handles every mouseup and checks allowWordAuto and allowSentenceAuto before translating without another click. — js/contentScript.js:1
Default configuration sets both automatic-translation options to false. — js/background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings, proxy, search, management, or privacy permissions. — manifest.json:14-19
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The minified code retains named translation, history, OCR, settings, and network flows. — js/translate.js:1
Remote endpoints and message types remain literal and readable. — js/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The apparent Function text is only jQuery's isFunction predicate, not a code constructor. — js/cache.js:1
Remote results are placed into text fields, text nodes, sanitized templates, audio buffers, or image data rather than executed. — js/translate.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
The Translate Website action queries the active tab URL and submits it to /translateWebpageAPI. — js/translate.js:1
The fixed getCurrentPageUrl message returns the active tab URL to extension UI. — js/background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent installation UUID and automatically reports install or update status, version, and time to the vendor.
Generates mtz_uuid, sends it with vendor configuration and service requests, and POSTs install/update metadata to u-language.com/new. — js/background.js:1
Maintains local visitor and visit counters, but contains no outbound analytics endpoint. — js/piwik.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
References undefined onUserLogin and onUserReg functions; bookmark sync runs only when stored userLogged and token values already exist. — js/background.js:1
Requests no cookies permission. — manifest.json:14-19
Does it record typing, form entries, clipboard contents, or screenshots?
It reads selected text after mouse release, but does not record general keystrokes or form values.
Calls getSelectedText on mouseup and accepts only text-node selections. — js/contentScript.js:1
The Enter and paste handlers apply only to the extension's own translation input. — js/translate.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The only window-message command accepted from the page is the fixed mtzCloseFrame string, which merely hides extension UI. — js/contentScript.js:1
Declares no externally_connectable interface. — manifest.json:1-66
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Builds packaged translator controls and appends them to the page. — js/translateContent.js:1
Adds and removes the OCR selection overlay. — frame/Scripts/cs.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It performs remote translation, OCR, text-to-speech, dictionary, webpage-translation, configuration, install-reporting, and optional bookmark-sync requests.
Implements Backenster and Google requests for translation-related features. — js/translate.js:1
Implements vendor config and install calls, Backenster OCR, and Lingvanex bookmark sync. — js/background.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:14-19
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Handles remote results as text, sanitized dictionary content, audio, URLs, or numeric settings. — js/translate.js:1
Remote configuration is read as notification timing and content; no eval or script loader consumes it. — js/background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
receiveMessage checks only for mtzCloseFrame and hides the translator container. — js/contentScript.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defaults automatic word and sentence translation to false, but automatically sends install/update metadata and fetches config. — js/background.js:1
Requires the user to draw an OCR region before image upload. — frame/Scripts/cs.js:1
Uses text setters, Mustache escaping, and DOMPurify for remote translation and dictionary output. — js/translate.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is configuration, messaging, OCR upload, and optional bookmark sync. — js/background.js:1
Foreground work is UI, translation, audio playback, and local history handling. — js/translate.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates namespaced translator controls rather than modifying existing page forms. — js/translateContent.js:1
Reads selected text and positions extension UI without changing form destinations. — js/contentScript.js:1