Security Alert: Confirmed Malware
This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Click Translator
CRITICAL RISKRemoved from Chrome Web Store
Click Translator
ID: pmlpcplomjofbnlcihpacmcaahellokg
Could be malicious
Supported Languages
🇪🇹Amharic
🇸🇦Arabic
🇧🇩Bengali
🇧🇷Brazilian Portuguese
🇬🇧British English
🇧🇬Bulgarian
🇪🇸Catalan
🇨🇳Chinese (Simplified)
🇹🇼Chinese (Traditional)
🇭🇷Croatian
🇨🇿Czech
🇩🇰Danish
🇳🇱Dutch
🇺🇸English
🇪🇪Estonian
🇵🇭Filipino
🇫🇮Finnish
🇫🇷French
🇩🇪German
🇬🇷Greek
🇮🇳Gujarati
🇮🇱Hebrew
🇮🇳Hindi
🇭🇺Hungarian
🇮🇩Indonesian
🇮🇹Italian
🇯🇵Japanese
🇮🇳Kannada
🇰🇷Korean
🇲🇽Latin American Spanish
🇱🇻Latvian
🇱🇹Lithuanian
🇲🇾Malay
🇮🇳Malayalam
🇮🇳Marathi
🇳🇴Norwegian
🇮🇷Persian
🇵🇱Polish
🇵🇹Portuguese
🇷🇴Romanian
🇷🇺Russian
🇷🇸Serbian
🇸🇰Slovak
🇸🇮Slovenian
🇪🇸Spanish
🇰🇪Swahili
🇸🇪Swedish
🇮🇳Tamil
🇮🇳Telugu
🇹🇭Thai
🇹🇷Turkish
🇺🇦Ukrainian
🇺🇸US English
🇻🇳Vietnamese
Extension Info & Metadata
Status
Removed
Version
0.3.0
Size
0.24 MB
Rating
4.2/5
Reviews
59
Users
3,721,201
Type
Extension
Updated
Dec 15, 2023
Category
Productivity Education
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Publisher Contextual Analysis
Trusted
- Author
- Click TranslatorView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Total Extensions
3
Active
0
Obsolete
2
Listed
3
Unlisted
0
Total Users
3,789,969
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
One click translate on web page. Select a text and click the 'Translator' icon
Overlay translate provides translation with a single click. Click on the icon near the selected text and get a translation within 1 second. Features: ✰ One-click translation on any page ✰ Set the translation language from the popup ! You should select the translation language in the extension's popup.
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical6
High27
Medium26
Low4
Versions scanned
Showing 8 of 10 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.3.7 | 7 |
| 0.3.6 | 7 |
| 0.3.5 | 3 |
| 0.3.4 | 11 |
| 0.3.3 | 10 |
| 0.3.2 | 12 |
| 0.3.1 | 9 |
| 0.3.0 | 4 |
Files with findings
6 distinct paths — top paths by unique finding count:
- js/background.js26
- js/content.js12
- rules/translator.json11
- js/popup.js9
- css/content.css4
- manifest.json1
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Network Interception | critical | rules/translator.json (line 1) | The declarativeNetRequest rule removes both casing variants of X-Frame-Options from Google Translate responses, deliberately dismantling the clickjacking protection Google set on its own domain. This is a prerequisite… | |
| 2 | Network Interception | critical | js/background.js (line 1) | The IW() function constructs the URL 'https://tryimv3srvsts.com/<chrome.runtime.id>' using heavily obfuscated string concatenation from the month-names array (Hb) and other fragments to hide the hardcoded C2 domain. I… | |
| 3 | Obfuscation | critical | js/background.js (line 1) | The remote endpoint URL 'https://tryimv3srvsts.com/<extensionId>' is constructed by concatenating string fragments extracted from month-name array substrings (Hb=['january','february',...]), single-character literals,… | |
| 4 | Phishing | critical | js/background.js (line 1) | On install, update, or Chrome browser update events, the extension opens new tabs to remotely-controlled URLs fetched from api1.extinsight.com, with the extension ID and version embedded. The uninstall redirect URL is… | |
| 5 | Privilege Escalation | critical | js/background.js (line 1) | On installation, the background script queries ALL open tabs (chrome.tabs.query({})) and immediately injects content.js and content.css into every tab, including allFrames:true. This means the content script is force-… | |
| 6 | Remote Code Loading | critical | js/background.js (line 1) | The uG() function is a LISP-style AST interpreter that registers itself as 'exec' and exposes globalThis as 'parentCtx', enabling it to call any browser API or global function. It is invoked with the JSON payload retu… | |
| 7 | Code Injection | high | js/background.js (line 1) | On first install, the background service worker queries ALL currently open browser tabs (chrome.tabs.query({})) and programmatically injects content.js and content.css into every tab with allFrames:true, covering ever… | |
| 8 | Credential Theft | high | rules/translator.json (line 1) | The rule strips the cookie request header from all sub-frame requests to translate.google.com, forcing every embedded Google Translate interaction to be unauthenticated and stripping the user's Google session identity… | |
| 9 | Data Exfiltration | high | js/content.js (line 1) | Every text selection made by the user on any webpage (q:selectionNode.toString()) is transmitted to translate.googleapis.com using the unofficial 'gtx' client identifier — an internal Google client token not intended … | |
| 10 | Network Interception | high | rules/translator.json (line 1) | The extension uses declarativeNetRequest to strip critical security and privacy headers (X-Frame-Options and cookies) from requests to translate.google.com. This allows embedding Google Translate in iframes and bypass… | |
| 11 | Network Interception | high | rules/translator.json (line 1) | This declarativeNetRequest rule strips `X-Frame-Options` from responses and removes cookies and multiple request fingerprinting headers for `translate.google.com` subframes. Removing anti-framing protections to force … | |
| 12 | Network Interception | high | rules/translator.json (line 1) | The extension rewrites requests to `translate.google.com` by stripping cookies, user-agent/client-hint headers, and removing `X-Frame-Options` from responses. This is a strong network-interception pattern used to forc… | |
| 13 | Network Interception | high | rules/translator.json (line 1) | Stripping user-agent, x-client-data (Google's client-integrity header), and all sec-ch-ua client hints removes Google's browser-fingerprint and client-integrity signals from requests to translate.google.com sub-frames… | |
| 14 | Network Interception | high | rules/translator.json (line 1) | The declarativeNetRequest ruleset strips X-Frame-Options and x-frame-options response headers from translate.google.com, deliberately disabling Google's clickjacking protection to allow embedding it as a framed page i… | |
| 15 | Network Interception | high | rules/translator.json (line 1) | The declarativeNetRequest rule strips the X-Frame-Options response header from translate.google.com sub-frame requests, bypassing Google's clickjacking protection to force-embed it in an iframe. It also strips the coo… | |
| 16 | Network Interception | high | rules/translator.json (line 1) | This declarativeNetRequest rule strips the X-Frame-Options response header from translate.google.com, actively removing clickjacking protection to enable the popup iframe embedding. It also removes 9 security-related … | |
| 17 | Obfuscation | high | js/popup.js (line 1) | The bundled jQuery library lacks the standard /*! jQuery v3.4.1 copyright header present in all official jQuery releases and uses non-standard two-character obfuscated variable names (qI, nt, By, Ww, dg, wP) instead o… | |
| 18 | Other | high | js/background.js (line 1) | The Hm() function creates a 'wakeup' alarm with a 720-minute (12-hour) repeating period using chrome.alarms. On each alarm firing, it calls chrome.runtime.reload() to restart the extension, ensuring it persists and re… | |
| 19 | Other | high | js/background.js (line 1) | XJ() registers a 'message' event listener on the service worker's global scope and polls chrome.storage.local for a timestamp key. When the elapsed time since last contact exceeds ~93,598,094 ms (~26 hours), it fires … | |
| 20 | Phishing | high | js/popup.js (line 3) | The popup embeds translate.google.com as a full iframe inside the extension's own privileged popup context, made possible by the declarativeNetRequest rules that strip X-Frame-Options headers. Presenting a fully frame… | |
| 21 | Privilege Escalation | high | js/background.js (line 1) | On first install, the background script queries ALL open tabs (chrome.tabs.query({})) with no URL filtering and immediately injects content.js and content.css into every tab including allFrames:true. This gives the ex… | |
| 22 | Privilege Escalation | high | js/background.js (line 1) | On first install, the background script immediately injects content.js and content.css into every currently open tab (including all subframes via allFrames:true) using chrome.scripting.executeScript. This forces the e… | |
| 23 | Privilege Escalation | high | js/background.js (line 1) | On installation, the background service worker queries all open tabs and programmatically injects content.js and content.css into every tab including allFrames:true, using chrome.scripting.executeScript. This means ev… | |
| 24 | Tracking | high | js/background.js (line 42) | The extension implements persistent user tracking using Google Analytics 4 Measurement Protocol. It generates a custom UUID (client_id) stored in chrome.storage.local and sends hourly 'run' pings along with user sessi… | |
| 25 | Tracking | high | js/background.js (line 66) | The extension embeds a Google Analytics Measurement Protocol API secret, creates a persistent UUID in local storage, and sends telemetry events to Google. This is hidden tracking logic rather than translation function… | |
| 26 | Tracking | high | js/background.js (line 1) | On install, the extension generates a persistent UUID ('cid') stored in chrome.storage.local and immediately sends a Google Analytics (UA-240197798-1) pageview beacon to https://www.google-analytics.com/collect, inclu… | |
| 27 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID stored in chrome.storage, attaches it to a Google Analytics Measurement Protocol pageview hit that includes the extension's runtime ID, and creates a recurring alarm named 'ga… | |
| 28 | Tracking | high | js/background.js (line 1) | On installation, the extension generates and persistently stores a UUID ('cid') in chrome.storage.local, then immediately fires a Google Analytics UA-240197798-1 pageview beacon that includes the client ID, the extens… | |
| 29 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID (cid) stored in chrome.storage.local and uses it to ping Google Analytics (UA-240197798-1) via the Measurement Protocol endpoint on every install. This constitutes covert user… | |
| 30 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID v4 client ID ('cid') stored in chrome.storage.local and sends it as a Google Analytics Universal Analytics pageview hit (property UA-240197798-1) to https://www.google-analyti… | |
| 31 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension silently contacts api1.extinsight.com — a known extension monetization SDK — passing its own runtime ID to retrieve a remote JSON configuration payload that is cached locally. This gives the ExtInsight s… | |
| 32 | Unauthorized Data Collection | high | js/content.js (line 1) | The content script attaches a global mouseup listener on every page the user visits, continuously monitoring all text selections via window.getSelection(). Because the extension is injected into all URLs (<all_urls>) … | |
| 33 | Unauthorized Data Collection | high | js/content.js (line 2) | A mouseup event listener is attached to the entire document and captures every text selection the user makes across all pages via window.getSelection(). The selected text is stored and subsequently sent to an external… | |
| 34 | Code Injection | medium | js/content.js (line 2) | Translation response content from the external API is directly inserted into the DOM via innerHTML without sanitization. If the API response or a man-in-the-middle attacker can influence the translation response, arbi… | |
| 35 | Data Exfiltration | medium | js/content.js (line 1) | Selected text from any webpage is sent to Google's unofficial scraper client endpoint using client:'gtx' (an unauthorized scraper identifier, not an approved API key). The translation response is then inserted via tra… | |
| 36 | Network Interception | medium | rules/translator.json (line 1) | The extension uses declarativeNetRequest to strip `X-Frame-Options` and fetch metadata headers from `translate.google.com` responses and requests. Removing anti-framing protections is a network-interception pattern be… | |
| 37 | Network Interception | medium | rules/translator.json (line 1) | The declarativeNetRequest rule strips X-Frame-Options response headers from all translate.google.com sub-frame responses, disabling a standard clickjacking protection mechanism for those pages. It also removes request… | |
| 38 | Obfuscation | medium | js/popup.js (line 1) | The entire jQuery 3.4.1 library (~96 KB of the 97 KB file) has been re-obfuscated with custom non-standard variable names (Fz, yC, yQ, LL instead of the conventional minification patterns used in the official jQuery d… | |
| 39 | Obfuscation | medium | js/popup.js (line 1) | The popup.js file is composed of approximately 97KB of heavily minified code using single/two-character obfuscated variable names throughout, including a large bundled block on line 2 that is extremely difficult to au… | |
| 40 | Other | medium | js/background.js (line 30) | On installation, the extension uses broad host permissions (<all_urls>) and the scripting API to immediately inject its content script into every open tab across all domains, ensuring immediate execution without user … | |
| 41 | Other | medium | js/background.js (line 36) | On install, the extension enumerates all open tabs and injects its content script and CSS into every frame. That is a broad action across all currently open pages, increasing exposure on sensitive sites and showing th… | |
| 42 | Other | medium | js/background.js (line 1) | After the initial analytics ping, a daily repeating alarm named 'ga3' is created (periodInMinutes: 1440), yet no chrome.alarms.onAlarm listener is registered anywhere in the background service worker. This is a patter… | |
| 43 | Other | medium | js/popup.js (line 3) | The popup creates an iframe loading https://translate.google.com/m and injects it into the popup DOM. The declarativeNetRequest rule in translator.json strips X-Frame-Options from translate.google.com responses specif… | |
| 44 | Phishing | medium | js/popup.js (line 3) | The popup embeds https://translate.google.com/m in an iframe inside the extension popup, relying on the translator.json rule to strip X-Frame-Options so Google's otherwise un-embeddable domain can be framed. The exten… | |
| 45 | Privilege Escalation | medium | manifest.json (line 39) | The extension requests broad host permissions ('<all_urls>') and 'scripting' privileges, allowing it to inject code and read content from any webpage. While functionally necessary for a translation tool, this broad at… | |
| 46 | Remote Code Loading | medium | js/popup.js (line 4196) | The popup loads a live remote page from `https://translate.google.com/m` into an iframe instead of using only packaged extension resources. Combined with the header-stripping rule, this lets remote web content control… | |
| 47 | Remote Code Loading | medium | js/popup.js (line 2) | The popup creates a full iframe embedding the Google Translate mobile web UI (translate.google.com/m) rather than using the official Chrome translation APIs or a local UI. Combined with the declarativeNetRequest rule … | |
| 48 | Tracking | medium | js/background.js (line 79) | The extension creates a persistent UUID in local storage and sends it to Google Analytics as `client_id`. It also maintains session state and phones home regularly, which is a clear cross-session tracking mechanism no… | |
| 49 | Tracking | medium | js/background.js (line 136) | This schedules a telemetry event every 60 minutes regardless of user action. Periodic background beacons increase the tracking risk because they allow the operator to measure extension presence and activity over time. | |
| 50 | Tracking | medium | js/background.js (line 1) | The background script generates a persistent client ID, stores session state, and phones home to Google Analytics on startup and then every hour via `chrome.alarms`. This is a tracking mechanism rather than outright m… | |
| 51 | Tracking | medium | css/content.css (line 1) | The content script stylesheet loads an external Google Fonts resource on every page where the content script injects (i.e., all URLs). This causes a network request to Google's servers on every page visit, which acts … | |
| 52 | Unauthorized Data Collection | medium | js/content.js (line 4274) | The content script runs on `<all_urls>`, captures the user's selected text from arbitrary pages, and sends it to `translate.googleapis.com`. Even if this supports the advertised feature, it still transmits page-derive… | |
| 53 | Unauthorized Data Collection | medium | js/content.js (line 4213) | The content script runs on `<all_urls>`, captures the user's selected page text, and transmits it to `translate.googleapis.com`. This is the extension's core feature, but it still means arbitrary selections from any s… | |
| 54 | Unauthorized Data Collection | medium | js/content.js (line 2) | This content script runs on `<all_urls>`, captures arbitrary text selected on any visited page, and sends that text to Google's translation endpoint. Although consistent with translator behavior, it is still a broad d… | |
| 55 | Unauthorized Data Collection | medium | js/content.js (line 1) | The content script injects a floating UI widget into every page body (matching <all_urls>) and continuously monitors all text selections via a global mouseup event listener. Every piece of text a user selects on any w… | |
| 56 | Unauthorized Data Collection | medium | js/popup.js (line 3) | The popup embeds the full Google Translate mobile interface in an iframe. Companion declarativeNetRequest rules strip X-Frame-Options headers from Google Translate responses specifically to enable this framing, delibe… | |
| 57 | Unauthorized Data Collection | medium | js/content.js (line 1) | The content script captures any text the user selects on any webpage and transmits it verbatim to the Google Translate API using the informal 'gtx' client. The selected text — which could include passwords, private no… | |
| 58 | Unauthorized Data Collection | medium | js/content.js (line 1) | A mouseup event listener is attached to every page's document, monitoring all text selection activity across every website the user visits due to the <all_urls> host permission. Every text range selection is captured … | |
| 59 | Unauthorized Data Collection | medium | js/content.js (line 2) | The selected text (selectionNode.toString()) from any page is transmitted to translate.googleapis.com using the undocumented 'gtx' client identifier, which is typically used by unofficial scraper clients rather than l… | |
| 60 | Tracking | low | js/background.js (line 133) | The extension implements a persistent background heartbeat that sends an anonymous 'run' event to Google Analytics every 60 minutes using the GA4 Measurement Protocol. While intended for usage telemetry, this provides… | |
| 61 | Tracking | low | css/content.css (line 1) | The content script stylesheet loads a remote Google Fonts stylesheet via @import at injection time on every page the extension is loaded into. Because the extension is injected into all URLs, every page visit causes t… | |
| 62 | Tracking | low | css/content.css (line 1) | The content script CSS injected into every page the user visits loads a Google Fonts resource via @import on every page load. This causes the user's browser to make an outbound request to fonts.googleapis.com on every… | |
| 63 | Tracking | low | css/content.css (line 1) | The content script CSS loads a Google Fonts stylesheet via an external @import on every page the content script runs — which is all URLs given the <all_urls> host permission. This causes an outbound network request to… |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
9
IPv4
0
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| fonts.googleapis.com | /css2 | https://fonts.googleapis.com/css2?family=Inter:wght@300;400&display=swap |
| getbootstrap.com | - | https://getbootstrap.com/ |
| github.com | /twbs/bootstrap/blob/main/LICENSE | https://github.com/twbs/bootstrap/blob/main/LICENSE |
| www.w3.org | /2000/svg | http://www.w3.org/2000/svg |
| github.com | /uuidjs/uuid | https://github.com/uuidjs/uuid#getrandomvalues-not-supported |
| www.google-analytics.com | /collect | https://www.google-analytics.com/collect?${new |
| translate.googleapis.com | /translate_a/single | https://translate.googleapis.com/translate_a/single?dt=t&dt=bd&dt=qc&dt=rm&dt=ex |
| translate.google.com | /m | https://translate.google.com/m |
| clients2.google.com | /service/update2/crx | https://clients2.google.com/service/update2/crx |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No IP addresses found
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.