[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Chinese words separator: Chinese dictionary

Version 8.24.84.3240 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Rating: 4.8 ★ (49 ratings)

Users: 4,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has a relatively small user base of 4,000 users and a high rating of 4.8 from 49 reviews, which suggests positive user experience among those who have tried it. However, the limited adoption and lack of clear developer information raises questions about transparency and accountability. The extension appears to be a Chinese language learning tool based on its name and description.

Concerns:

The extension exhibits several red flags that justify the critical risk rating. The combination of identity permission with broad host permissions creates a dangerous scenario where the extension could potentially access user authentication data across all websites. The content script injection capability on all URLs means it can read and modify any webpage content, including sensitive information like passwords, financial data, and personal communications. The tabs permission allows monitoring of browsing behavior, while access to Google accounts specifically raises concerns about potential data harvesting from user profiles.

Recommendations:

Given the critical risk level, avoid installing this extension unless absolutely necessary. If you must use it, create a dedicated Chrome profile isolated from your main browsing activities, especially those involving sensitive accounts or financial services. Consider alternative Chinese language tools that require fewer permissions. Regularly monitor your Google account activity for any suspicious access patterns if you choose to proceed with installation.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://accounts.google.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
contextMenus
tts
identity
tabs

Host Permissions:

https://accounts.google.com/*

Embedded URLs (559 total):

https://www.youtube.com/watch?v=AKH5IHhbUUA	https://chinese-words-separator.github.io/hsk-3.0.html
https://quilljs.com	http://www.w3.org/2000/svg
https://stackoverflow.com/questions/43846713/removing-line-breaks-in-text-copied-from-a-flex-container	https://stackoverflow.com/questions/1749437/regular-expression-negative-lookahead
https://javascript.info/regexp-lookahead-lookbehind	https://www.anicehumble.com/2021/11/split-keep-lookbehind-match-loop.html
https://www.freecodecamp.org/news/what-is-rem-in-css/	https://github.com/nickdrewe/traditional-or-simplified/blob/master/TradOrSimp.js
https://mozilla.github.io/pdf.js/web/viewer.html?file=	https://stackoverflow.com/questions/12175124/window-location-href-not-working-in-chrome-extension
https://stackoverflow.com/a/46187624	https://stackoverflow.com/a/40606838
https://twitter.com/jaffathecake/status/1420315350009356293?s=61&t=R4m_x9Rc-f7Z6FjsZKqs1g	https://www.w3schools.com/css/css3_variables_javascript.asp
https://stackoverflow.com/questions/65250688/	https://raw.githubusercontent.com/chinese-words-separator/chinese-words-separator.github.io/main/dict/vn.txt
https://raw.githubusercontent.com/chinese-words-separator/chinese-words-separator.github.io/main/dict/jp.txt	https://raw.githubusercontent.com/chinese-words-separator/chinese-words-separator.github.io/main/dict/ph.txt
https://stackoverflow.com/questions/76301339/updating-a-progress-element-works-in-chrome-but-not-in-safari	https://www.google.com/search?q=
https://stackoverflow.com/questions/10965433/regex-replace-multi-line-breaks-with-single-in-javascript/10965543#10965543	https://www.supermemo.com/en/archives1990-2015/english/ol/sm2
https://www.ussherpress.com/freshcards/	https://www.chineseboost.com/blog/sentence-mining/
https://github.com/quilljs/quill/issues/2501	https://jsbin.com/ginanegoqu/edit?js
https://hanziyuan.net/#%s	https://youdao.com/w/eng/%s/#keyfrom=dict2.index
https://raw.githubusercontent.com/chinese-words-separator/chinese-words-separator.github.io/main/sentence-mining-list.tsv	https://resources.allsetlearning.com/chinese/grammar/%s
https://resources.allsetlearning.com/chinese/vocabulary/%s	https://youdao.com/example/blng/eng/%s/#keyfrom=dict.main.moreblng
https://raw.githubusercontent.com/chinese-words-separator/chinese-words-separator.github.io/main/char-other-info-v2.tsv	http://hanzidb.org/character/%s
https://docs.google.com/spreadsheets/d/1RY5tCL8FGmqswGe4PULs438zI7viGQbWG5CloxsijMw/edit?usp=sharing	https://www.bing.com/dict/search?q=%s&FORM=&mkt=zh-cn
https://english.dict.naver.com/english-chinese-dictionary/#/search?query=%s&range=example	https://context.reverso.net/translation/chinese-english/%s
https://zh.glosbe.com/zh/en/%s	https://www.omgchinese.com/dictionary/?q=%s&qt=0
https://tatoeba.org/eng/sentences/search?from=cmn&to=eng&query=%s	https://www.purpleculture.net/sample-sentences?word=%s
https://www.google.com/search?q=%s+site%3Awww.bbc.co.uk%2Flearningenglish%2Fchinese%2Ffeatures%2Ftodays-phrase	https://www.dong-chinese.com/wiki/%s
https://www.linguee.com/english-chinese/search?source=auto&query=%s	https://youglish.com/pronounce/%s/chinese/cn
https://www.iciba.com/word?w=%s	https://www.wordreference.com/zhen/%s
https://www.chineseboost.com/chinese-example-sentences?query=%s	https://raw.githubusercontent.com/chinese-words-separator/chinese-words-separator.github.io/main/dict/fr.txt
https://raw.githubusercontent.com/chinese-words-separator/chinese-words-separator.github.io/refs/heads/main/calligraphy.json	https://cdn.jsdelivr.net/npm/hanzi-writer-data@2.0.1/%s.json
https://www.google.com.hk/inputtools/request?ime=handwriting&app=mobilesearch&cs=1&oe=UTF-8	https://www.google.com/search?q=%s&udm=50
https://www.bing.com/translator?	https://www.deepl.com/
https://translate.google.com/	https://youdao.com/w/
https://youdao.com/example/blng/eng/.	https://www.purpleculture.net/sample-sentences
https://resources.allsetlearning.com/chinese/.	https://www.linguee.com/english-chinese/search
https://www.wordreference.com/zhen/.	https://chinese.yabla.com/.
https://deckademy.com/.	https://www.bbc.co.uk/learningenglish/chinese/features/todays-phrase/.
https://www.bing.com/dict/search	https://tatoeba.org/en/sentences/search
https://www.omgchinese.com/dictionary/.	https://www.iciba.com/word
https://english.dict.naver.com/english-chinese-dictionary/#/search	https://context.reverso.net/translation/chinese-english/.
https://context.reverso.net/%E7%BF%BB%E8%AF%91/%E4%B8%AD%E6%96%87-%E8%8B%B1%E8%AF%AD/.	https://zh.glosbe.com/zh/en/.
https://www.dong-chinese.com/wiki/.+/examples	https://www.chineseboost.com/chinese-example-sentences
https://accounts.google.com/o/oauth2/v2/auth?	https://sheets.googleapis.com/v4/spreadsheets/

Page 1 of 7

Raw Manifest

{
  "name": "__MSG_extension_name__",
  "icons": {
    "128": "fen.png"
  },
  "action": {
    "default_icon": "fen.png",
    "default_popup": "popup.html"
  },
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/spreadsheets"
    ],
    "client_id": "231393230302-kldrlakp23sncdj4jimqhan6u8h539g6.apps.googleusercontent.com"
  },
  "version": "8.24.84.3240",
  "commands": {
    "cycle-guide": {
      "description": "Cycle Guide",
      "suggested_key": {
        "mac": "Alt+G",
        "default": "Alt+G"
      }
    },
    "cycle-hanzi": {
      "description": "Cycle Hànzi font size",
      "suggested_key": {
        "mac": "Alt+H",
        "default": "Alt+H"
      }
    },
    "show-recall": {
      "description": "Recall words meaning"
    },
    "show-rewrite": {
      "description": "Practice writing characters"
    },
    "toggle-space": {
      "description": "Toggle Separate with space"
    },
    "cycle-dictionary": {
      "description": "Cycle Dictionary"
    },
    "cycle-guide_size": {
      "description": "Cycle Guide's size"
    },
    "toggle-both_chars": {
      "description": "Toggle Dictionary's Show both traditional and simplified"
    },
    "activate-extension": {
      "description": "Enable/disable extension"
    },
    "toggle-guide_position": {
      "description": "Toggle guide's position (above/under)"
    },
    "cycle-separating_colors": {
      "description": "Cycle Separating colors",
      "suggested_key": {
        "mac": "Alt+C",
        "default": "Alt+C"
      }
    },
    "toggle-box_garden_paths": {
      "description": "Toggle underline for garden-path"
    },
    "toggle-dictionary_on_off": {
      "description": "Dictionary quick on/off"
    },
    "toggle-learned_words_color": {
      "description": "Exclude/include learned words from colors and guides"
    },
    "toggle-automatic_read_aloud": {
      "description": "Toggle Automatic read aloud of hovered word/phrase"
    },
    "show-learning_tracking_sheet": {
      "description": "Show learning tracking sheet"
    },
    "toggle-show_guide_when_hovered": {
      "description": "Toggle show guide only when hovered"
    }
  },
  "background": {
    "service_worker": "chinese-words-separator--background-wrapper.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extension_description__",
  "permissions": [
    "storage",
    "contextMenus",
    "tts",
    "identity",
    "tabs"
  ],
  "options_page": "options.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content-script.js"
      ],
      "css": [],
      "run_at": "document_idle",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_origin_as_fallback": true
    },
    {
      "js": [
        "netflix-injecter.js"
      ],
      "run_at": "document_end",
      "matches": [
        "https://www.netflix.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://accounts.google.com/*"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "constants-frontend.mjs",
        "constants-common.mjs",
        "tokenize.mjs",
        "page-effecter.mjs",
        "page-changes.mjs",
        "page-events.mjs",
        "page-parser.mjs",
        "learned-marker.mjs",
        "page-utils.mjs",
        "storage.mjs",
        "settings.mjs",
        "content-script.mjs",
        "db-requests.mjs",
        "api_.mjs",
        "api-common.mjs",
        "api-frontend.mjs",
        "long-press.mjs",
        "notification.mjs",
        "pinyin-utils.mjs",
        "translate-utils.mjs",
        "sidebar-utils.mjs",
        "hanzi-writer.mjs",
        "dictionary-common.mjs",
        "dictionary-sentence-utils.mjs",
        "dictionary-word-utils.mjs",
        "guide-shower.mjs",
        "top-unlearned.mjs",
        "search.mjs",
        "page-hsk-percentages.mjs",
        "chinese-sim-tra-detector.mjs",
        "emoji-heart.png",
        "emoji-dict.png",
        "emoji-read-aloud.png",
        "translator-bing-logo.png",
        "translator-deepl-logo.png",
        "translator-google-logo.png",
        "clipboard.mjs",
        "micro-modal.mjs",
        "cws-dialog.mjs",
        "calligraphy.mjs",
        "calligraphy-ime.mjs",
        "notes.html",
        "learning-tracking-sheet.mjs",
        "read-aloud-cross-platform.mjs",
        "lookup-unique-hanzi-pinyin-tone-hsk-dc.tsv",
        "lookup-separable-verbs.tsv",
        "lookup-word-frequency.tsv",
        "lookup-hanzi-with-matches.mjs",
        "state.mjs",
        "tooltip.mjs",
        "fen.png",
        "website-specific.mjs",
        "chinese-garden.png",
        "dragon-wallpaper.jpg",
        "parallel-text.mjs",
        "reading-parallel-text-common.mjs",
        "swiped-events.mjs",
        "web-hsk.mjs",
        "learner-speak.mjs",
        "writing-system-detector.mjs",
        "tldts.js",
        "keyboard.mjs",
        "handwriting.canvas.mjs"
      ]
    },
    {
      "matches": [
        "https://www.netflix.com/*"
      ],
      "resources": [
        "netflix-intercepter.js"
      ]
    }
  ]
}

by ✦ Astarte

Chinese words separator: Chinese dictionary

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (559 total):

Raw Manifest

Detections

Manifest Findings