[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Dual Subtitles & AI Translation - InterSub

Version 4.46.0 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: InterSub Inc

Rating: 4.6 ★ (214 ratings)

Users: 20,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a solid user base of 20,000 users and maintains a strong 4.6-star rating from 214 reviews, indicating generally positive user experiences. The developer InterSub Inc appears to be a legitimate company focused on subtitle and translation services. The extension's purpose of providing dual subtitles and AI translation for video streaming platforms is clearly defined and useful.

Concerns: The extension requests several high-risk permissions that raise significant privacy and security concerns. The identity and identity.email permissions allow access to your Google account information, which seems unnecessary for subtitle functionality. The webRequest permission enables interception and modification of all web traffic, creating potential for data theft or malicious redirects. The broad host permissions (<all_urls>) grant access to every website you visit, far exceeding what's needed for supported streaming platforms. The unlimitedStorage permission could be used to store excessive amounts of potentially sensitive data.

Recommendations: Given the high-risk permissions, consider running this extension in a separate Chrome profile to isolate it from your main browsing activities and sensitive accounts. Regularly review what data the extension has access to through Chrome's privacy settings. Monitor your network traffic when using the extension to ensure it's not making unexpected connections. Consider whether the subtitle translation features are worth the extensive permissions required, and look for alternative extensions with more limited permissions if available.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
identity
identity.email
unlimitedStorage
webRequest

Host Permissions:

<all_urls>

Embedded URLs (41 total):

http://www.w3.org/ns/ttml	http://www.w3.org/ns/ttml#styling
https://api.bilibili.tv/intl/gateway/web/v2/ogv/play/episode?s_locale=	https://angular.io/
https://g.co/ng/security#xss	http://www.w3.org/2000/svg
http://www.w3.org/1999/xhtml	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/xmlns/
http://www.w3.org/1998/MathML/	https://intersub.cc
https://plugin.intersub.cc/	https://www.topcreativeformat.com/watchnew?key=75e6cfc4a860e18ab603937fd2ee1e10
https://www.topcpmcreativeformat.com/watchnew?key=897c9a1afc7921c849ff61f7f26fabf8	https://analytics.google.com/g/collect
https://ngrx.io/guide/store/configuration/runtime-checks	https://www.youtube.com/watch?v=rWghO6I-K1M
https://discord.com/invite/AgdxpVmHhb	https://clients2.google.com/service/update2/crx
https://www.bilibili.tv/	https://www.biliintl.com/
https://kino.pub/	https://angular.io/license
https://translate.googleapis.com/translate_a/single	https://edge.microsoft.com/translate/auth
https://api-edge.cognitive.microsofttranslator.com/translate	https://example.com/too-long
https://www.udemy.com/course/	https://www.domestika.org/api/v2/video_item_m3u8/
https://learngerman.dw.com	https://intersub.cc/
https://chrome.google.com/webstore/detail/intersub-learn-languages/hhbnckjhjihjangdepdebbnooibiphge/reviews	https://chromewebstore.google.com/detail/intersub-learn-languages/hhbnckjhjihjangdepdebbnooibiphge
https://www.youtube.com/watch?v=Nn7xwfKZSxQ	https://t.me/learn_english_w_intersub
https://www.netflix.com/watch/80223961?trackId=14170286	https://www.coursera.org/learn/google-introduction-to-ai/lecture/kk6MS/introduction-to-google-ai-essentials
https://github.com/googlefonts/carlito	http://scripts.sil.org/OFL
https://github.com/Fonthausen/NunitoSans

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "48": "assets/images/icon48.png",
    "128": "assets/images/icon128.png",
    "512": "assets/images/icon512.png"
  },
  "action": {
    "default_icon": {
      "48": "assets/images/icon48.png",
      "128": "assets/images/icon128.png",
      "512": "assets/images/icon512.png"
    },
    "default_popup": "popup.html",
    "default_title": "__MSG_actionDefaultTitle__"
  },
  "version": "4.46.0",
  "background": {
    "service_worker": "service-worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDescription__",
  "permissions": [
    "storage",
    "identity",
    "identity.email",
    "unlimitedStorage",
    "webRequest"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content-script.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "alloha-tv-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.newplayjj.com/*",
        "https://*.thealloha.club/*",
        "https://*.pljjalgo.online/*",
        "https://*.allarknow.online/*",
        "https://*.online-serial.com/*",
        "https://*.algonoew.online/*",
        "https://*.stloadi.live/*",
        "https://*.lordfilm64.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "amazon-prime-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.primevideo.com/*",
        "https://*.amazon.com/*",
        "https://*.amazon.co.uk/*",
        "https://*.amazon.de/*",
        "https://*.amazon.co.jp/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "bilibili-tv-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://www.bilibili.tv/*",
        "https://www.biliintl.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "crunchyroll-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.crunchyroll.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "hbo-max-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.brightline.tv/*",
        "https://*.cinemax.com/*",
        "https://*.discomax.com/*",
        "https://*.forthethrone.com/*",
        "https://*.hbo.com/*",
        "https://*.hboasia.com/*",
        "https://*.hbogo.co.th/*",
        "https://*.hbogo.com/*",
        "https://*.hbogo.eu/*",
        "https://*.hbogoasia.com/*",
        "https://*.hbogoasia.hk/*",
        "https://*.hbogoasia.id/*",
        "https://*.hbogoasia.ph/*",
        "https://*.hbogoasia.sg/*",
        "https://*.hbogoasia.tw/*",
        "https://*.hbomax.com/*",
        "https://*.hbomaxcdn.com/*",
        "https://*.hbonow.com/*",
        "https://*.max.com/*",
        "https://*.maxgo.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "kinopub-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://kino.pub/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "netflix-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.netflix.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "ororo-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.ororo.tv/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "two-sub-movie-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.2sub.net/*",
        "https://*.2sub.movie/*",
        "https://*.2sub.pro/*",
        "https://*.yohoho.tv/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {},
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "assets/*",
        "*.css",
        "*.js"
      ]
    }
  ]
}

by ✦ Astarte

Dual Subtitles & AI Translation - InterSub

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (41 total):

Raw Manifest

Detections

Manifest Findings