Read Aloud: A Text to Speech Voice Reader

What This Extension Does

The Read Aloud: A Text to Speech Voice Reader extension allows users to read aloud web-page articles with one click, supporting over 40 languages. It appears to be an accessibility-focused extension that enables text-to-speech functionality.

Permissions Explained

• activeTab: Allows the extension to access and interact with the currently active tab in the browser.

+ Standard for this type of extension.

• contextMenus: Enables the extension to create custom context menus within the browser.

+ Unusual, but not necessarily a security concern; more likely related to the extension's UI features.

• identity: Grants access to user identity information, such as login credentials and profile data.

+ Unusual for an accessibility-focused extension like this. It may be used for features that aren't explicitly mentioned in the description (e.g., personalized settings or integration with other services).

• offscreen: Allows the extension to run scripts on pages that are not currently visible in the browser.

+ Standard for extensions that need to perform background tasks, but could potentially be misused if not properly sandboxed.

• scripting: Enables the extension to execute scripts within web pages.

+ Standard for this type of extension; necessary for text-to-speech functionality and other interactive features.

• storage: Grants access to browser storage mechanisms (e.g., local storage, session storage).

+ Standard for extensions that need to store user data or settings.

• tts and ttsEngine: Permissions related to text-to-speech functionality, which is the primary purpose of this extension.

+ Expected and necessary for its intended use case.

• webRequest: Allows the extension to intercept and modify web requests made by the browser.

+ HIGH-risk permission; unusual for an accessibility-focused extension like this. It may be used for features that aren't explicitly mentioned in the description (e.g., ad blocking, content filtering).

• https://translate.google.com/: A specific permission granted to a Google Translate domain.

What We Found in the Code

• [high] Function constructor used — dynamic code execution: This flag is likely related to the extension's use of text-to-speech functionality or other interactive features. It may be using eval() or similar constructs for dynamic code execution, which can pose security risks if not properly sanitized.
• [medium] innerHTML assignment — potential XSS vector: This flag is likely a normal coding pattern used for UI rendering within the extension's interface. However, it's worth noting that innerHTML assignments can potentially lead to cross-site scripting (XSS) vulnerabilities if untrusted data is being inserted into the DOM.
• [info] Makes HTTP requests: This is a standard behavior for extensions that need to communicate with external services or APIs.

External Connections

The extension communicates with several domains, including:

• GitHub (github.com)
• Google Translate and Text-to-Speech APIs (translate.google.com, texttospeech.googleapis.com)
• Other Google-related domains (docs.google.com, books.googleusercontent.com)
• Custom domains related to the extension's functionality (support.readaloud.app, readaloud.app)

These connections appear expected for an accessibility-focused extension that provides text-to-speech functionality and integrates with external services.

Things to Consider

Based on this analysis, users may want to consider the following:

• The extension's use of the webRequest permission is unusual for its intended purpose. While it may be necessary for certain features, it could also indicate broader access to user data or browsing behavior.
• The extension's reliance on dynamic code execution and innerHTML assignments may pose security risks if not properly sanitized.
• Users should carefully review the extension's permissions and functionality to ensure they align with their expectations.

Ultimately, users must weigh these findings against their individual needs and preferences when deciding whether to install and use this extension.