[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Language Learning with Dual Subtitles & AI Translation - InterSub

Version 4.42.0 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Developer: InterSub Inc

Rating: 4.6 ★ (197 ratings)

Users: 20,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a solid 4.6-star rating from 197 reviews and 20,000 users, indicating positive user experience. The company "InterSub Inc" appears to be a legitimate developer focused on language learning tools. The extension's purpose - providing dual subtitles and AI translation for language learning - is clearly defined and valuable.

Concerns: The extension requests several concerning permissions that create significant privacy and security risks. The identity and identity.email permissions allow access to your Google account information, which is excessive for a subtitle tool. The webRequest permission enables intercepting and potentially modifying all web traffic, creating opportunities for data theft or malicious modifications. The broad host permissions (<all_urls>) grant access to every website you visit, far beyond the streaming platforms listed in content scripts. The combination of these permissions creates a powerful surveillance capability that extends well beyond the extension's stated purpose.

Recommendations: Consider running this extension in a separate Chrome profile to isolate it from your main browsing activities and sensitive accounts. Before installation, verify if similar functionality is available through extensions with more limited permissions. If you proceed with installation, regularly review the extension's behavior and consider removing it if you notice unusual network activity or performance issues. Monitor your accounts for any unauthorized access, given the identity permissions requested.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
identity
identity.email
unlimitedStorage
webRequest

Host Permissions:

<all_urls>

Embedded URLs (38 total):

http://www.w3.org/ns/ttml	http://www.w3.org/ns/ttml#styling
https://angular.io/	https://clients2.google.com/service/update2/crx
https://kino.pub/	https://intersub.cc
https://plugin.intersub.cc/	https://www.topcreativeformat.com/watchnew?key=75e6cfc4a860e18ab603937fd2ee1e10
https://www.topcpmcreativeformat.com/watchnew?key=897c9a1afc7921c849ff61f7f26fabf8	https://learngerman.dw.com
https://g.co/ng/security#xss	http://www.w3.org/2000/svg
http://www.w3.org/1999/xhtml	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/xmlns/
http://www.w3.org/1998/MathML/	https://analytics.google.com/g/collect
https://ngrx.io/guide/store/configuration/runtime-checks	https://www.youtube.com/watch?v=rWghO6I-K1M
https://discord.com/invite/AgdxpVmHhb	https://intersub.cc/
https://chrome.google.com/webstore/detail/intersub-learn-languages/hhbnckjhjihjangdepdebbnooibiphge/reviews	https://chromewebstore.google.com/detail/intersub-learn-languages/hhbnckjhjihjangdepdebbnooibiphge
https://angular.io/license	https://translate.googleapis.com/translate_a/single
https://edge.microsoft.com/translate/auth	https://api-edge.cognitive.microsofttranslator.com/translate
https://example.com/too-long	https://www.udemy.com/course/
https://www.domestika.org/api/v2/video_item_m3u8/	https://github.com/googlefonts/carlito
http://scripts.sil.org/OFL	https://www.youtube.com/watch?v=Nn7xwfKZSxQ
https://www.netflix.com/watch/80223961?trackId=14170286	https://www.coursera.org/learn/google-introduction-to-ai/lecture/kk6MS/introduction-to-google-ai-essentials
https://github.com/Fonthausen/NunitoSans	https://t.me/learn_english_w_intersub

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "48": "assets/images/icon48.png",
    "128": "assets/images/icon128.png",
    "512": "assets/images/icon512.png"
  },
  "action": {
    "default_icon": {
      "48": "assets/images/icon48.png",
      "128": "assets/images/icon128.png",
      "512": "assets/images/icon512.png"
    },
    "default_popup": "popup.html",
    "default_title": "__MSG_actionDefaultTitle__"
  },
  "version": "4.42.0",
  "background": {
    "service_worker": "service-worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDescription__",
  "permissions": [
    "storage",
    "identity",
    "identity.email",
    "unlimitedStorage",
    "webRequest"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content-script.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "alloha-tv-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.newplayjj.com/*",
        "https://*.thealloha.club/*",
        "https://*.pljjalgo.online/*",
        "https://*.allarknow.online/*",
        "https://*.online-serial.com/*",
        "https://*.algonoew.online/*",
        "https://*.stloadi.live/*",
        "https://*.lordfilm64.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "amazon-prime-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.primevideo.com/*",
        "https://*.amazon.com/*",
        "https://*.amazon.co.uk/*",
        "https://*.amazon.de/*",
        "https://*.amazon.co.jp/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "crunchyroll-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.crunchyroll.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "hbo-max-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.brightline.tv/*",
        "https://*.cinemax.com/*",
        "https://*.discomax.com/*",
        "https://*.forthethrone.com/*",
        "https://*.hbo.com/*",
        "https://*.hboasia.com/*",
        "https://*.hbogo.co.th/*",
        "https://*.hbogo.com/*",
        "https://*.hbogo.eu/*",
        "https://*.hbogoasia.com/*",
        "https://*.hbogoasia.hk/*",
        "https://*.hbogoasia.id/*",
        "https://*.hbogoasia.ph/*",
        "https://*.hbogoasia.sg/*",
        "https://*.hbogoasia.tw/*",
        "https://*.hbomax.com/*",
        "https://*.hbomaxcdn.com/*",
        "https://*.hbonow.com/*",
        "https://*.max.com/*",
        "https://*.maxgo.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "kinopub-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://kino.pub/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "netflix-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.netflix.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "ororo-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.ororo.tv/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "two-sub-movie-subtitle-sniffer-injector.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.2sub.net/*",
        "https://*.2sub.movie/*",
        "https://*.2sub.pro/*",
        "https://*.yohoho.tv/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {},
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "assets/*",
        "*.css",
        "*.js"
      ]
    }
  ]
}

by ✦ Astarte

Language Learning with Dual Subtitles & AI Translation - InterSub

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (38 total):

Raw Manifest

Detections

Manifest Findings