Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: PolyPodder

CRITICAL RISKRemoved from Chrome Web Store

PolyPodder

ID: mbakfjliknbhemfibjfiancgpndfcmgb

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.1.1

Size

0.07 MB

Rating

0.0/5

Reviews

Users

Type

Extension

Updated

Jul 22, 2025

Publisher Contextual Analysis

Author: PolyPodderView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

Smart German learning assistant powered by AI: Get instant translations, grammar insights, and cultural context while browsing.

Learn German seamlessly as you browse! Select text for instant translations or open the chat assistant to ask questions, practice phrases, and get detailed explanations. Complete with native pronunciations and grammar insights.

User Growth

Showing data from Jan 26, 2025 to Apr 25, 2026

Versions

-11.11%(-1 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Item	Type	Severity	Description
identity	Permission	High	This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 25% increase: Unsafe code evaluation capabilities increase attack surface
Unsafe WebAssembly Execution	Risk Factor	High	This extension's CSP allows "wasm-unsafe-eval".
activeTab	Permission	Medium	This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
https://polypodder-backend.vercel.app/*	Host	Medium	Host permission — access limited to this URL pattern.
https://firebasestorage.googleapis.com/*	Host	Medium	Host permission — access limited to this URL pattern.
Access to Sensitive Domains	Risk Factor	Medium	This extension requests access to sensitive domains: https://firebasestorage.googleapis.com/*

Sensitive Domain Access

This extension has access to the following sensitive domains:

https://firebasestorage.googleapis.com/*

Content script injects backend-supplied fields (translation, vocabularyAnalysis, grammarExplanation, culturalContext, etc. returned from https://polypodder-backend.vercel.app) into the DOM of arbitrary web pages via innerHTML with no sanitization. A compromised or malicious backend response could deliver HTML/script-like payloads into every page the user visits. Not overtly malicious, but a meaningful XSS sink worth documenting.

content.js (Line 217)

function updatePopupWithAnalysis(analysis) {  if (!popup) return;  // 1. 翻译和发音  popup.querySelector('.translation-text')    .innerHTML =    `${analysis.translation || 'No translation available'}${analysis.model_used ?             `<span style="font-size: 11px; background: ${analysis.model_used.includes('gpt-4') ? '#4ade80' : '#fbbf24'}; color: ${analysis.model_used.includes('gpt-4') ? '#064e3b' : '#92400e'}; padding: 2px 6px; border-radius: 12px; margin-left: 8px;">${analysis.model_used}</span>` : ''}`;  // ...  const vocabSection = popup.querySelector('.vocabulary-section');  if (vocabSection) {    vocabSection.innerHTML = analysis.vocabularyAnalysis ?      `<div class="vocab-card vocab-color">${analysis.vocabularyAnalysis.replace(/\n/g, '<br>')}</div>` :      '';  }  // ...  blocks +=    `<div class="analysis-card grammar-color"><div class="card-title">GRAMMAR</div><div>${analysis.grammarExplanation.replace(/\n/g, '<br>')}</div></div>`;

Popup renders Firestore history documents (item.text, item.translation, item.audioUrl) directly into innerHTML without escaping. Since the records originate from arbitrary web pages the user selected text on, any page that plants specially crafted text could land stored HTML in the user's extension popup. Low severity because it affects only the authenticated user's own history, but it is an unsanitized sink.

popup.js (Line 630)

historyList.innerHTML = items.map((item, index) => {  let sourceDisplay = 'Unknown source';  if (item.sourceUrl) {    try {      const url = new URL(item.sourceUrl);      sourceDisplay = url.hostname.replace(/^www\./, '');    } catch (e) {      /* ... */ }  }  return `                <div class="history-item">                    <div class="history-item-content">                        <div class="text-container">                            <div class="selected-text">${item.text}</div>                            ${item.audioUrl ? `                                <button class="audio-btn" data-text="${item.text}" data-audio-url="${item.audioUrl}" title="Listen">                                    ...                                </button>                            ` : ''}                        </div>                        <div class="translation">${item.translation}</div>                        <div class="meta-info">                            <span class="source" title="${item.sourceUrl || ''}">${sourceDisplay}</span>                            <span class="timestamp">${new Date(item.timestamp).toLocaleString()}</span>                        </div>                    </div>                </div>            `;}).join('');

By severity

Critical0

High0

Medium0

Low2

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.1 Code review	2

Extension Version	Code Review Findings
1.1.1	2

Files with findings

2 distinct paths — top paths by unique finding count:

content.js1
popup.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Other	low	content.js (line 217)	Content script injects backend-supplied fields (translation, vocabularyAnalysis, grammarExplanation, culturalContext, etc. returned from https://polypodder-backend.vercel.app) into the DOM of arbitrary web pages via i…	1.1.1
2	Other	low	popup.js (line 630)	Popup renders Firestore history documents (item.text, item.translation, item.audioUrl) directly into innerHTML without escaping. Since the records originate from arbitrary web pages the user selected text on, any page…	1.1.1

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


polypodder-backend.vercel.app	-	https://polypodder-backend.vercel.app
identitytoolkit.googleapis.com	/v1/accounts%60;	https://identitytoolkit.googleapis.com/v1/accounts`;
storage.googleapis.com	/$%7BfirebaseConfig.storageBucket%7D/audio/$%7Bresult.userId%7D/$%7BsafeText%7D.mp3%60;	https://storage.googleapis.com/${firebaseConfig.storageBucket}/audio/${result.userId}/${safeText}.mp3`;
firebasestorage.googleapis.com	/v0/b/$%7BfirebaseConfig.storageBucket%7D/o/audio%2F$%7Bresult.userId%7D%2F$%7BsafeText%7D.mp3	https://firebasestorage.googleapis.com/v0/b/${firebaseConfig.storageBucket}/o/audio%2F${result.userId}%2F${safeText}.mp3?alt=media`;
firestore.googleapis.com	/v1/projects/$%7Bdata.firebaseConfig.projectId%7D/databases/(default	https://firestore.googleapis.com/v1/projects/${data.firebaseConfig.projectId}/databases/(default
firebasestorage.googleapis.com	/v0/b/$%7BfirebaseConfig.storageBucket%7D/o/$%7BencodeURIComponent(filename	https://firebasestorage.googleapis.com/v0/b/${firebaseConfig.storageBucket}/o/${encodeURIComponent(filename
firebasestorage.googleapis.com	/v0/b/$%7BfirebaseConfig.storageBucket%7D/o/$%7BencodeURIComponent(uploadResult.name	https://firebasestorage.googleapis.com/v0/b/${firebaseConfig.storageBucket}/o/${encodeURIComponent(uploadResult.name
firestore.googleapis.com	/v1/projects/$%7BprojectId%7D/databases/(default	https://firestore.googleapis.com/v1/projects/${projectId}/databases/(default
firestore.googleapis.com	/v1/projects/$%7BfirebaseConfig.projectId%7D/databases/(default	https://firestore.googleapis.com/v1/projects/${firebaseConfig.projectId}/databases/(default
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#

Showing 1 to 10 of 30 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found

Version	Size	Is Malicious	Findings	Permhash
1.1.1 Latest	0.07 MB	Malicious	2	723a203a4ea86fcef704b8376b611270f9136a27e6f18bfac82096b8c70b4646
1.0.3	0.06 MB	Malicious	—	723a203a4ea86fcef704b8376b611270f9136a27e6f18bfac82096b8c70b4646
1.0.4	0.07 MB	Malicious	—	723a203a4ea86fcef704b8376b611270f9136a27e6f18bfac82096b8c70b4646

Showing 1 to 3 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

PolyPodder

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Sensitive Domain Access

Code Analysis

Code Review Findings Summary Across 3 Versions2

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

Security Alert: Confirmed Malware

PolyPodder

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Sensitive Domain Access

Code Analysis

Otherlowcontent.js

Otherlowpopup.js

Code Review Findings Summary Across 3 Versions2

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating