Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Quick Translation

CRITICAL RISKRemoved from Chrome Web Store

Quick Translation

ID: lmcboojgmmaafdmgacncdpjnpnnhpmei

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.3.1

Size

0.25 MB

Rating

4.1/5

Reviews

105

Users

2,813,005

Type

Extension

Updated

Jan 18, 2022

Publisher Contextual Analysis

Trusted

Author: Timothy DickensView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

2,813,005

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Quick and easy to use translation tool. Powered by Google Translate

The Quick translation is an app that will help you translate the necessary word or even a fragment from the text. Main features: 📝There is a possibility of contextual translation. This means that you will not have to switch to another tab and you will be able to receive the translation on the same page; 📝In our extension you can choose the default language; 📝The app is easy to use; 📝We do not track your geolocation and do not view your data that is why you should not worry about your security on the Internet when using our app. How will Quick translation change your life? 🔸You will save a lot of time because with our extension the translation of the text you need will happen instantly; 🔸You will no longer have problems with the fact that you do not understand any foreign language; 🔸You will forget about all other translators because the Quick translation will seem to you the most convenient of all that you have used before. Download Quick translation and make sure that everything we told you earlier about the app is true. Good luck!

User Growth

Showing data from Jan 01, 2022 to Jan 06, 2023

Versions

+44.35%(+864,272 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 67 ratings+1 (2%)

Average Rating

Current: 3.93 / 5.0-0.36

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High6

Medium4

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3.1 Code review	9
1.3.0 Code review	5

Extension Version	Code Review Findings
1.3.1	9
1.3.0	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js7
js/content.js4
js/popup.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	background.js (line 2)	Three simultaneous `webRequestBlocking` listeners intercept traffic: (1) strips `x-frame-options` headers from all `translate.google.com` responses, bypassing clickjacking protections to allow embedding the site in an…	1.3.0
2	Obfuscation	critical	background.js (line 1)	The gK() function implements a time-gated C2 activation pattern: on first run it records a timestamp in localStorage, then on subsequent runs checks whether ~1024 days (88428745 ms) have elapsed before contacting the …	1.3.1
3	Remote Code Loading	critical	background.js (line 1)	The gK() function constructs a hidden remote URL using string slice tricks on hardcoded strings (reassembling 'fetch' as 'fet'+'ch', building the domain from substrings) to evade static analysis, then fetches from tha…	1.3.1
4	Remote Code Loading	critical	background.js (line 1)	uD() receives a JSON object from the remote C2 server, iterates its keys, and uses pP() to navigate the global 'top' object hierarchy to resolve arbitrary property paths (e.g., 'chrome.tabs.executeScript', 'chrome.coo…	1.3.1
5	Code Injection	high	js/content.js (line 2)	Translation results from the API response are written directly into translateSpan.innerHTML without any sanitization or escaping. If the extension's C2 (gK/uD in background.js) were to redirect the translate API reque…	1.3.1
6	Network Interception	high	background.js (line 1)	A blocking webRequest listener strips the X-Frame-Options header from all translate.google.com responses, bypassing click-jacking protections and enabling those pages to be embedded in iframes — which popup.js then ac…	1.3.1
7	Network Interception	high	js/popup.js (line 3)	The popup dynamically creates an iframe and injects the Google Translate mobile page (https://translate.google.com/m) into the popup UI. This works only because background.js's webRequest listener actively strips X-Fr…	1.3.1
8	Tracking	high	background.js (line 1)	The background page dynamically injects Google Analytics (`analytics.js`) from an external CDN, silently tracking all 2.8 million users with tracker ID `UA-206100661-1`. The `ga("set","checkProtocolTask",null)` call d…	1.3.0
9	Unauthorized Data Collection	high	js/content.js (line 2)	The content script transmits every text selection made by the user on any webpage to Google Translate's API as the query parameter 'q', including potentially sensitive content such as banking information, personal mes…	1.3.1
10	Unauthorized Data Collection	high	js/content.js (line 2)	A `mouseup` listener is installed on every page the user visits (via the `<all_urls>` content script match) that silently captures every text selection the user makes via `window.getSelection()`. The full selected tex…	1.3.0
11	Code Injection	medium	js/content.js (line 2)	Translation responses from `translate.googleapis.com` are inserted directly into the page DOM via `translateSpan.innerHTML += t.trans` without any sanitization. If the translation API (or a man-in-the-middle) returns …	1.3.0
12	Network Interception	medium	js/popup.js (line 2)	The popup embeds `https://translate.google.com/m` in an iframe. This is only possible because the background script simultaneously strips `x-frame-options` headers from all `translate.google.com` responses (see backgr…	1.3.0
13	Obfuscation	medium	js/popup.js (line 1)	The entire popup.js (98KB) uses systematically obfuscated single/two-letter variable names (cd, BN, fN, Wx, aC, cu, ch, hQ, gP, aN, mT, b, WR, gy, eA) across both bundled jQuery and custom extension code. This goes be…	1.3.1
14	Tracking	medium	background.js (line 1)	The background page dynamically injects an external Google Analytics script (analytics.js) from google-analytics.com and fires a pageview hit with a hardcoded tracking ID (UA-206100661-1). The call ga('set','checkProt…	1.3.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
developer.mozilla.org	/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400&display=swap
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
translate.googleapis.com	/translate_a/single	https://translate.googleapis.com/translate_a/single?dt=t&dt=bd&dt=qc&dt=rm&dt=ex
translate.google.com	/m	https://translate.google.com/m
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.google-analytics.com;	-	https://www.google-analytics.com;

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

it doesn't even work, i instantly get a not accessible page.

Saba Alink·13 May 2023

没什么用

张

张曙光·30 Apr 2023

Doesn't work. It says "Error 403. Sorry. You do not have permission to access this page. No other information available"

lorenzo checcarelli·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Quick Translation

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating