[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Lingvo Translator+

Version 0.1.10 View in Chrome Web Store

Last scanned: about 22 hours ago

Extension Details

Developer: Abbyy USA Software House, Inc.

Rating: 4.2 ★ (77 ratings)

Users: 4,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 3 high-risk findings.

Findings

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe JavaScript Evaluation

This extension's Content Security Policy allows 'unsafe-eval', which permits dynamic JavaScript code execution using eval() and similar functions. This is a significant security risk as it could allow execution of malicious code.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

tabs
http://*/*
https://*/*
contextMenus
webNavigation

Content Security Policy:

script-src 'self' 'unsafe-eval'; object-src 'self'

Embedded URLs (51 total):

http://www.w3.org/1999/xhtml	https://lingvolive.ru/translate/:srclang-:dstlang/:word?utm_source=extension
https://developer.mozilla.org/en-US/docs/Web/API/Document/xmlVersion	https://lingvolive.ru/
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://developer.chrome.com/extensions/tut_analytics	https://developers.google.com/analytics/devguides/collection/protocol/v1/devguide
https://blog.mozilla.org/addons/2016/05/31/using-google-analytics-in-extensions/	https://www.google-analytics.com/collect
http://code.google.com/apis/analytics/docs/tracking/asyncTracking.html	http://stackoverflow.com/questions/105034/create-guid-uuid-in-javascript
https://api.lingvolive.com/Translation/Minicard?	https://api.lingvolive.com/server/info/supported/languages
https://lingvolive.ru/:pathname?utm_source=fullextension&utm_medium=plugin&utm_campaign=	https://lingvolive.com/:pathname?utm_source=fullextension&utm_medium=plugin&utm_campaign=
http://kangoextensions.com/docs/api-reference/kango-io.html	http://phrasebook.lingvolive.com/api/phrasebook/:srclang-:dstlang/
http://phrasebook.lingvolive.com	http://phrasebook.lingvolive.com/api/phrasebook/:srclang-:dstlang/:theme_id
https://clients2.google.com/service/update2/crx	http://kangoextensions.com/
http://backbonejs.org	http://diveintohtml5.info/history.html
https://developer.mozilla.org/en-US/docs/DOM/window.onhashchange	http://marionettejs.com
https://github.com/marionettejs/backbone.babysitter/	https://github.com/marionettejs/backbone.wreqr/
http://github.com/marionettejs/backbone.babysitter	http://backbonejs.org/docs/backbone.html#section-106
http://github.com/marionettejs/backbone.wreqr	http://backbonejs.org/docs/backbone.html#section-121
http://marionettejs.com/docs/v	http://lostechies.com/derickbailey/2011/12/12/composite-js-apps-regions-and-region-managers/
https://github.com/marionettejs/backbone.marionette/wiki/Using-marionette-with-requirejs	http://api.jquery.com/event.namespace/
http://mutedsolutions.mit-license.org/	https://github.com/marionettejs/backbone.marionette
https://github.com/marionettejs/backbone.marionette/blob/master/license.txt	http://derickbailey.lostechies.com
https://github.com/marionettejs/backbone.marionette/issues	https://github.com/marionettejs/backbone.marionette.git
http://airbnb.github.com/polyglot.js	http://underscorejs.org
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-tolength	http://en.wikipedia.org/wiki/Fisher
http://docs.python.org/library/functions.html#range	https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object/assign
http://wiki.ecmascript.org/doku.php?id=harmony:egal	http://zeptojs.com/
http://perfectionkills.com/global-eval-what-are-the-options/

Raw Manifest

{
  "name": "Lingvo Translator+",
  "icons": {
    "16": "icons/button.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "version": "0.1.10",
  "background": {
    "page": "background.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "ABBYY Lingvo Translator+ Extension",
  "permissions": [
    "tabs",
    "http://*/*",
    "https://*/*",
    "contextMenus",
    "webNavigation"
  ],
  "homepage_url": "https://lingvolive.ru/",
  "browser_action": {
    "default_icon": "icons/icon.png",
    "default_popup": "popup.html",
    "default_title": "ABBYY Lingvo Live"
  },
  "content_scripts": [
    {
      "js": [
        "includes/content.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true
    }
  ],
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'",
  "web_accessible_resources": [
    "res/*",
    "assets/*",
    "icons/*"
  ]
}

by ✦ Astarte

Lingvo Translator+

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (51 total):

Raw Manifest

Detections

Manifest Findings