Is Aub's Omnipotent Image Translator safe?

Low risk

Aub's Omnipotent Image Translator sends your Google account email and the page URL to Alibaba telemetry on each translate.

When you translate an image from the context menu, the extension reads your Google account email and combines it with the page URL and image URL. It sends these in a telemetry beacon to Alibaba's ARMS service, with the email used as the user identifier. The image itself is handled by the extension's own translation backend.

Aubarinov1.0.65Chrome Web Store
22Risk
Who publishes it

Aubarino - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Aubarino
Website
discord.gg/8UMuEdDYEs

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Image translate sends your Google email and page URL to Alibaba ARMS telemetry

Code analysis shows each translate action reports the Chrome profile email, page URL and image URL to arms-retcode.aliyuncs.com, an Alibaba telemetry host.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You right-click an image and pick the translate menu item.

The popup translate button triggers a similar report.

The extension did this

The extension reports your profile email with the page and image address to an Alibaba ARMS host.

The email is empty if no Google account is signed into Chrome.

Fields in the telemetry report
  • Profile email
    jane.doe@gmail.com (illustrative)

    Your Chrome profile Google account email, sent as the user ID.

  • Page URL
    https://example.com/products/42 (illustrative)

    Address of the tab where you used translate.

  • Image URL
    https://example.com/img/42.jpg (illustrative)

    Address of the image you chose to translate.

The code that does this

Email read in the service worker, then used as the ARMS uid in the content script

Readable version

ARMS singleton keyed by email

assets/contentLogger.js-CuJLjWMS.js
const se = (e) =>  _t.singleton({    pid: "aa9hucpddy@f07435a50fe14e0",    uid: e,    appType: "web",    imgUrl: "https://arms-retcode.aliyuncs.com/r.png?",  });

Handler that reports email with the URLs

assets/contentLogger.js-CuJLjWMS.js
function Et(e) {  chrome.storage.sync.get(["g_user_info"]).then(({ g_user_info: t }) => {    const r = t.email,      n = se(r);    n.sum("bgTranslate", 1),      n.error(new Error(JSON.stringify(e)), { filename: "点击图标开始翻译", lineno: 384, colno: 18 });  });}chrome.runtime.onMessage.addListener(function (e, t, r) {  e.type === "bg-log" ? Et(e.data) : /* other log types */ 0;});
Where the report goes
    • arms-retcode.aliyuncs.com

    Alibaba Cloud ARMS retcode endpoint; receives the email as uid plus the page and image URLs.

Check if you're affected

Searches an unpacked copy of the extension for the code that builds the ARMS report from the profile email.

find_arms_beacon.sh · sh
#!/bin/sh# Run inside the unpacked extension directorygrep -rn "arms-retcode.aliyuncs.com" assets/ | cut -c1-160grep -rn "g_user_info" assets/contentLogger.js-*.js | cut -c1-160grep -n "type: \"bg-log\"" assets/background.js-*.js
How to run it
  1. 1Unpack the CRX.
  2. 2cd into the folder.
  3. 3Run sh find_arms_beacon.sh.
  4. 4Match the hits to the email-as-uid path above.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.65. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Show a panel beside the page

    sidePanel

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

  • Run its own code inside the pages you visit

    scripting

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed Aub's Omnipotent Image Translator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ai.imgkits.com

    Aub's Omnipotent Image Translator sends data to ai.imgkits.com. 10 other extensions we have analysed send data here.

  • arms-retcode.aliyuncs.com

    Aub's Omnipotent Image Translator sends data to arms-retcode.aliyuncs.com. 8 other extensions we have analysed send data here.

Updated 15 October 2026moooomjnjdmhilaabhdkappiecdggnje