Navable Chrome extension security report

-Navable is a voice-first accessibility Chrome extension designed to help blind, low-vision, and hands-free users navigate websites more easily. With Navable, users can speak or type commands such as “scroll down,” “list headings,” “list links,” “read focused element,” “open link,” or “summarize this page.” The extension scans the current webpage, identifies useful elements such as headings, links, buttons, and form fields, then provides clear feedback through screen-reader-friendly announcements. Key features: • Voice and typed web navigation commands • Page structure scanning for headings, links, buttons, inputs, and landmarks • Screen-reader compatible feedback using ARIA live regions • Optional Chrome text-to-speech output • AI-assisted page summaries and question answering through a backend API • Custom new-tab page for quick website opening and search • Basic form navigation and guided interaction support • Local fallback commands when AI features are unavailable Navable is built as an academic graduation project focused on improving web accessibility and reducing the effort needed to interact with complex webpages. It is not intended to replace screen readers. Instead, it works alongside them by adding a voice-controlled navigation layer inside the browser. Some AI-powered features require the Navable backend to be running or configured. Core navigation commands can still work through the extension’s local command handling. Navable requires broad content_scripts matches because its single purpose is accessibility-focused voice and typed navigation on arbitrary webpages chosen by the user. The extension must read page structure such as headings, links, buttons, form labels, and visible text so it can perform user-requested navigation, summaries, and browser actions. We reduced host_permissions to only https://navable.onrender.com/* for backend API calls. The broad page access remains only in content_scripts.matches because Navable needs to operate across normal websites, not a fixed set of domains. Sensitive password and payment fields are excluded from summaries where supported, and user data is not sold or used for advertising.