[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

DeepL: translate and write with AI

Version 1.72.0 View in Chrome Web Store

Last scanned: about 13 hours ago

Extension Details

Developer: DeepL

Rating: 4.7 ★ (12.2K ratings)

Users: 4,000,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

DeepL is a reputable German AI translation company with 4 million users and a strong 4.7-star rating from over 12,000 reviews. The extension is officially developed by DeepL, which adds significant credibility. The large user base and positive ratings suggest the extension generally functions as intended without major security incidents.

Concerns:

The extension's permission set is extremely broad for a translation tool. The combination of webRequest interception, cookie access, identity permissions, and content script injection across all websites creates significant privacy and security risks. The unsafe WebAssembly execution policy is particularly concerning as it could hide malicious code. While these permissions may be necessary for advanced translation features like webpage translation and user authentication, they collectively grant extensive access to user data and browsing activity.

The broad host permissions and all-URL content script injection mean this extension can monitor and potentially modify any website you visit. The webRequest and cookies permissions could allow tracking of your browsing patterns and session data.

Recommendations:

Despite DeepL's reputation, consider running this extension in a separate Chrome profile dedicated to translation tasks. Alternatively, use DeepL's web interface directly for sensitive translations. If keeping the extension, regularly review its activity in Chrome's extension management and consider disabling it when not actively needed. Monitor for any unusual network activity or performance issues that might indicate misuse of the extensive permissions.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
storage
contextMenus
tabs
scripting
declarativeNetRequest
identity
tts
alarms
webRequest
cookies
sidePanel

Host Permissions:

*://*.deepl.com/*
https://api-test.deepl.com/v1/*
https://api.deepl.com/v1/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'

Embedded URLs (110 total):

https://support.deepl.com/hc/en-us/articles/4407573562386-Languages-in-the-browser-extension	https://www.deepl.com/pro
https://www.figma.com/design/gk5NT1CPVZKTQEjheaO2kA/Example-for-localization-testing?node-id=911-37&node-type=frame&t=IXRol98M1lMauqhO-0	https://jira.deepl.dev/browse/TNL-711
https://www.deepl.com/translator/files	https://support.deepl.com/hc/de/articles/4407573562386-Languages-in-the-browser-extension
https://support.deepl.com/hc/es/articles/4407573562386-Languages-in-the-browser-extension	https://support.deepl.com/hc/fr/articles/4407573562386-Languages-in-the-browser-extension.
https://support.deepl.com/hc/it/articles/4407573562386-Languages-in-the-browser-extension.	https://support.deepl.com/hc/ja/articles/4407573562386-Languages-in-the-browser-extension
https://support.deepl.com/hc/nl/articles/4407573562386-Languages-in-the-browser-extension	https://support.deepl.com/hc/pl/articles/4407573562386-Languages-in-the-browser-extension
https://support.deepl.com/hc/pt-br/articles/4407573562386	https://support.deepl.com/hc/pt/articles/4407573562386-Languages-in-the-browser-extension
https://support.deepl.com/hc/ru/articles/4407573562386-Languages-in-the-browser-extension.	https://support.deepl.com/hc/en-us/articles/4407573562386-Languages-in-the-browser-extension.
https://support.deepl.com/hc/zh-cn/articles/4407573562386-	http://www.apache.org/licenses/
http://auth0.com	https://mathiasbynens.be/
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://auth.deepl.com
https://www.deepl.com	https://s.deepl.com/chrome/statistics
https://api.deepl.com/jsonrpc?client=chrome-extension	https://www2.deepl.com/jsonrpc?client=chrome-extension
https://write-pro.www.deepl.com/jsonrpc?client=chrome-extension	https://write-free.www.deepl.com/jsonrpc?client=chrome-extension
https://api.deepl.com/termbases/jsonrpc?client=chrome-extension	https://ita-free.www.deepl.com/v1
https://ita-pro.www.deepl.com/v1	https://oneshot-free.www.deepl.com/v1
https://oneshot-pro.www.deepl.com/v1	https://www.deepl.com/auth/login
https://w.deepl.com/oidc/auth	https://w.deepl.com/oidc/token
https://w.deepl.com/oidc/cookie_bearer_exchange	https://www.deepl.com/auth/logout
https://deepl.qualtrics.com/jfe/form/SV_5hVyvZAQlQOL5RQ	https://deepl.qualtrics.com/jfe/form/SV_eJxAD8c7J5hqSRU
https://www.deepl.com/pro-write	https://www.deepl.com/translator
https://www.deepl.com/en/pro-license?tab=free	https://www.deepl.com/signup
https://bit.ly/DeepL-Chrome	https://support.deepl.com/hc/articles/4407580229522
https://support.deepl.com/hc	https://chromewebstore.google.com/detail/deepl-translate-and-write/cofdbpoegempjloogbagkncekinflcnj
https://microsoftedge.microsoft.com/addons/detail/deepl-translate-and-writ/fancfknaplihpclbhbpclnmmjcjanbaf	https://addons.mozilla.org/en-US/firefox/addon/deepl-translate/
https://support.mozilla.org/kb/manage-extension-shortcuts-firefox	https://addons.mozilla.org/en-US/firefox/addon/deepl-translate/privacy/
https://w.deepl.com/web	https://experimentation.deepl.com/experiments
https://www.deepl.com/en/microsoft-365	https://www.deepl.com/en/signup?cta=free-login-signup
https://www.deepl.com/extension-uninstall	https://w.deepl.com/account?request_type=jsonrpc&il=en&method=getCurrentAccount
https://w.deepl.com/organization	https://www.deepl.com/restricted-territories
https://web.whatsapp.com	https://www.twitter.com
https://www.youtube.com	https://www.facebook.com
https://www.github.com	https://www.discord.com
https://web.telegram.org	https://www.reddit.com
https://www.gmail.com	https://docs.google.com
https://slides.google.com	https://www.linkedin.com/
https://www.office.com/	http://www.example.com
http://www.w3.org/2000/svg	https://sentry.io/welcome/
https://0d368beeb4bc3e66f983b2c83eb342dc@o4509354486530048.ingest.de.sentry.io/4509882758201424	https://experimentation.deepl.com/experiments/
https://www-app.linguee.com/	https://w.deepl.com/organization/logo/

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "images/deepl_16.png",
    "32": "images/deepl_32.png",
    "48": "images/deepl_48.png",
    "128": "images/deepl_128.png"
  },
  "action": {
    "default_icon": {
      "16": "images/deepl_16.png",
      "32": "images/deepl_32.png",
      "48": "images/deepl_48.png",
      "128": "images/deepl_128.png"
    },
    "default_popup": "index.html"
  },
  "storage": {
    "managed_schema": "schema.json"
  },
  "version": "1.72.0",
  "commands": {
    "change-language": {
      "name": "change-language",
      "description": "__MSG_extension_settings_keyboard_shortcut_change_language__",
      "suggested_key": {
        "mac": "Command+Shift+L",
        "default": "Ctrl+Shift+L"
      }
    },
    "trigger-translation": {
      "name": "trigger-translation",
      "description": "__MSG_extension_settings_keyboard_shortcut_perform_translation__",
      "suggested_key": {
        "mac": "Command+Shift+Y",
        "default": "Ctrl+Shift+Y"
      }
    },
    "screenshot-translation": {
      "name": "screenshot-translation",
      "description": "__MSG_screenshot_translation_title__"
    }
  },
  "background": {
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "settings.html",
    "open_in_tab": true
  },
  "side_panel": {
    "default_path": "side-panel.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "activeTab",
    "storage",
    "contextMenus",
    "tabs",
    "scripting",
    "declarativeNetRequest",
    "identity",
    "tts",
    "alarms",
    "webRequest",
    "cookies",
    "sidePanel"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "build/content.js"
      ],
      "css": [
        "build/content.css"
      ],
      "run_at": "document_idle",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "*://*.deepl.com/*",
    "https://api-test.deepl.com/v1/*",
    "https://api.deepl.com/v1/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "ruleset_1",
        "path": "rules.json",
        "enabled": true
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "images/*.svg",
        "images/**/*.svg"
      ]
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "build/content.css"
      ]
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "onboarding.html"
      ]
    },
    {
      "matches": [
        "chrome-extension://ocpdpnakdghopjcifldjidbdmfobmmoi/*"
      ],
      "resources": [
        "build/dev-page.css"
      ]
    },
    {
      "matches": [
        "chrome-extension://ocpdpnakdghopjcifldjidbdmfobmmoi/*"
      ],
      "resources": [
        "tesseract/*"
      ]
    }
  ]
}

by ✦ Astarte

DeepL: translate and write with AI

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (110 total):

Raw Manifest

Detections

Manifest Findings