Chrome Web StoreDo not install
Code review: critical (v1.0.2)
Our reviewer read version 1.0.2 of this extension and confirmed malicious behaviour. 3 security findings documented below. Do not install it. Remove it if you already have it.
3 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Speech to Text is rated malicious by Extension Auditor. Our code review reported 3 findings (3 critical), led by data exfiltration. It was last updated in July 2026.
Key findings
- Critical
Data Exfiltration
A hardcoded bearer token and upload endpoint pointing to a bare IP address () are embedded in the extension. This server is not affiliated with any disclosed publisher service, is not a known SaaS, and receives raw audio data from users without their knowledge or consent. The token authenticates uploads to this attacker-controlled endpoint.
- Critical
Data Exfiltration
Every time the user starts speaking, a MediaRecorder silently records the raw microphone audio in parallel with the Web Speech API transcription. When recording stops, the full audio blob is unconditionally uploaded to the attacker's server via uploadAudio(). The user sees only a speech-to-text UI with no indication that their voice is being captured and exfiltrated.
- Critical
Data Exfiltration
This function POSTs the recorded audio blob to the hardcoded IP endpoint with a Bearer token. The destination () is not the publisher's disclosed domain, not a known SaaS, and not mentioned anywhere in the CWS listing or privacy policy. Combined with the MediaRecorder capture in startRecording(), every session's audio is silently exfiltrated to an attacker-controlled server.
Analyst notes
The extension covertly records all microphone audio via MediaRecorder (:280-307) and silently POSTs every recording to a bare IP address ([domain withheld]) with a hardcoded bearer token (:3-4), regardless of any Web Speech API result. This behavior is completely undisclosed — the CWS listing declares zero data collection and the description mentions only the local Web Speech API. The raw IP appears intentionally in host_permissions to authorise the upload, confirming premeditated design. Third-party risk score (low likelihood) and ML score (0.09) both underestimated the threat because they did not inspect the audio-upload code path; the source code is unambiguous.
Speech to Text Chrome extension security report
ID: pkpbcancahlnlobpemdohiammbegbfhl
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- tailscale.rookie@gmail.com
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Screenshots & videos
Install growth
3 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Засварлах боломжтой текст болон монголоор бичих боломжтой дуут бичвэр (кирилл + латин галиглал).
Read the publisher’s full description
Энэхүү extension нь Chrome-ийн Web Speech API ашиглан таны яриаг шууд текст болгож хувиргана. Монгол хэл, англи хэл дэмжинэ. Бичвэрээ ярьсныхаа дараа засварлах мөн үгний зөв эсэх шалгах боломжтой. ХЭРЭГЛЭХ ЗААВАР: 1. Microphone товчийг дарж зөвшөөрөл өгнө 2. Ярих хэлээ сонгоно (Монгол / English) 3. Бичих гарын төрөл сонгоно 5. Хуулах эсвэл цэвэрлэх товчоор үргэлжлүүлнэ This extension uses Chrome’s Web Speech API to convert your speech into text in real time. It supports both Mongolian and English. After dictating, you can edit the text and check spelling accuracy. HOW TO USE: 1. Click the Microphone button and grant permission 2. Select your speaking language (Mongolian / English) 3. Choose your keyboard/input type 4. Use the Copy or Clear button to continue
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
3 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Tools
- Claude20,000,000 users
- Zotero Connector9,000,000 users
- ChatGPT8,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users
- WPS PDF - Read, Edit, Fill, Convert, and AI Chat PDF with Ease7,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.