Google Translate
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Highlight or right-click on a section of text and click on Translate icon next to it to translate it to your language.
Learn more about Google Translate at https://support.google.com/translate.
By installing this extension, you agree to the Google Terms of Service and Privacy Policy at https://www.google.com/intl/en/policies.
UPDATE (v.2.0): Now you can highlight or right-click a text and translate it vs. translate the entire page. You can also change extension options to automatically show translation every time you highlight text.
UPDATE (v.2.14+): Page translation is now supported natively in Chrome browsers and is no longer supported in the Google Translate extension. See https://support.google.com/chrome/answer/173424 to learn how to use it.
Tags
Privacy Practices
Security Analysis — Google Translate
Permissions
Code Patterns Detected
External Connections
Package Contents 73 files · 7.7MB
What This Extension Does
The Google Translate extension allows users to easily translate text on web pages, solving the problem of language barriers while browsing. It's suitable for anyone who needs to communicate across languages. However, its functionality has been partially replaced by native Chrome features.
Permissions Explained
- activeTabexpected: This permission allows the extension to access and modify the current web page.
Technical: The activeTab permission grants access to the tab's URL, title, and content. It also enables the extension to inject scripts into the page and interact with its DOM. - contextMenusexpected: This permission allows the extension to add custom context menu items for translation.
Technical: The contextMenus permission enables the extension to create and manage context menus, which can be used to inject scripts or display additional UI elements. - storagecheck this: This permission allows the extension to store data locally on your device.
Technical: The storage permission grants access to local storage, which can be used to cache translation data or store user preferences. However, it also increases the attack surface if compromised. ⚠ 1 - offscreenexpected: This permission allows the extension to access web pages that are not currently visible in the browser window.
Technical: The offscreen permission enables the extension to interact with web pages even when they're not in focus, which can be useful for background tasks like caching or indexing. - scriptingcheck this: This permission allows the extension to execute scripts on web pages.
Technical: The scripting permission grants access to the page's content script injection API, which can be used to inject custom scripts or modify the page's behavior. ⚠ 1
Your Data
The extension accesses web pages' content and sends data to Google servers for translation. It also stores user preferences locally on your device.
Technical Details
- www.w3.org
- translate-pa.googleapis.com
- github.com
- translate.google.com
- csp.withgoogle.com
- translate.googleapis.com
- support.google.com
- HTTPS
- cookies
- tokens
Code Findings
The extension uses the eval() function to execute JavaScript code, which can lead to security vulnerabilities if exploited.
Technical: The eval() function is used in the extension's content script (translate.js) to dynamically evaluate user-supplied input. This can be exploited by malicious users to inject arbitrary code.
💡 Legitimate extensions may use eval() for dynamic code evaluation, but it's essential to ensure that user input is properly sanitized and validated.
The extension uses String.fromCharCode to obfuscate its code, making it harder for users to understand what the extension is doing.
Technical: The String.fromCharCode function is used in the extension's content script (translate.js) to encode strings. While this can be used for legitimate purposes like encoding user data, it may also indicate an attempt to hide malicious behavior.
💡 Legitimate extensions may use obfuscation techniques to protect their code or improve performance.
The extension uses charCodeAt to obfuscate its code, making it harder for users to understand what the extension is doing.
Technical: The charCodeAt function is used in the extension's content script (translate.js) to extract character codes from strings. While this can be used for legitimate purposes like encoding user data, it may also indicate an attempt to hide malicious behavior.
💡 Legitimate extensions may use obfuscation techniques to protect their code or improve performance.
The Google Translate extension has some security concerns due to its use of eval() and potential data exposure. However, it's a widely used and trusted extension with a good reputation. Users should be cautious when granting permissions and monitor their browser activity for any suspicious behavior.
