CRX aminer
Extension icon

Anki Dictionary

Version 2.1.15 View in Chrome Web Store

Last scanned: about 12 hours ago

Extension Details

Developer: wordwise.me
Rating: 4.1 ★ (22 ratings)
Users: 1,000

Context-Aware Verdict

CRITICAL
Overall Risk
Trust Factors:

The extension has a relatively small user base of only 1,000 users, which limits community validation. The 4.1 rating from 22 reviews provides minimal confidence given the small sample size. The developer "wordwise.me" appears to be associated with a language learning service, which aligns with the extension's purpose as an Anki dictionary tool. However, the lack of detailed developer information and limited adoption raises trust concerns.

Concerns:

The extension exhibits several red flags that justify the critical risk rating. The identity permission is particularly concerning as it can access personal authentication data, which seems unnecessary for a dictionary function. The tabs permission combined with broad content script injection across all URLs creates significant privacy and security risks. The extension can read and modify content on every website you visit, potentially capturing sensitive information like passwords, financial data, or personal communications. The host permissions to Supabase and Google Analytics suggest data collection and external transmission capabilities.

Recommendations:

Given the critical risk level, avoid installing this extension on your primary browser profile. If you must use it, create a dedicated Chrome profile specifically for this extension and limit your browsing activities in that profile to non-sensitive websites. Consider alternative Anki dictionary extensions with more restrictive permissions or use standalone dictionary applications instead. The broad permissions far exceed what's typically necessary for dictionary functionality, making this extension unsuitable for general use.

Findings

HIGH
Broad Content Script Injection
This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.
HIGH
Broad Host Permissions
This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.
HIGH
High-Risk Permission: identity
This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: tabs
This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.
MEDIUM
Access to Sensitive Domains
This extension requests access to sensitive domains: https://wordwise.me/*, https://www.google-analytics.com/*. Ensure you trust this extension with access to these sites.
MEDIUM
Medium-Risk Permission: contextMenus
This extension has the contextMenus permission. Can add items to the context menu.
MEDIUM
Medium-Risk Permission: storage
This extension has the storage permission. Can store data locally.