Is AudioTTS - Simple Text to Speech Downloader safe?

High risk

AudioTTS - Simple Text to Speech Downloader is high risk. On supported AI or text-to-speech pages, AudioTTS inserts page scripts that call license.baabullah.my.id for telemetry. The call uses JSONP, so the response loads as JavaScript inside the same page as the extension's code.

baabullahv2.1.12Chrome Web Store

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH

ClassUNWANTED

TypeUnexpected

CWECWE-829

SourceAI SANDBOX

JSONP telemetry runs server-supplied JavaScript

On supported AI or text-to-speech pages, AudioTTS inserts page scripts that call license.baabullah.my.id for telemetry.

The call uses JSONP, so the response loads as JavaScript inside the same page as the extension's code.

01EvidenceCAUSE EFFECT

What actually happens

You did this

You use AudioTTS on a supported text-to-speech page.

The shipped call sites are in the Google and Azure text-to-speech flows.

The extension did this

The extension asks license.baabullah.my.id for telemetry using JSONP.

A JSONP response is loaded as a script, so server-supplied JavaScript can run in the page where the extension inserted its helper code.

02EvidenceFIELD TABLE

Fields placed in the /stat query string

	Field	Value	Why it matters
	Selected speech service	Google	Shows which supported text-to-speech service you were using when the telemetry call was made.
	Text length marker	len_1024	Shows the size of the text submitted to the text-to-speech workflow, without including the text itself in this code path.

03EvidenceNETWORK CAPTURE

Captured request

GEThttps://license.baabullah.my.id/stat?engine=Google&message=len_1024

Verification evidence records the JSONP request shape. This GET path has no request body.

04EvidenceCODE COMPARE

The code that does this

The page-script injection and JSONP telemetry path

What it actually does

Show shipped source

Readable effect of loadScriptcontentscript.js

function loadExtensionScriptIntoPage(file, callback) {
  const script = document.createElement('script');
  script.src = chrome.runtime.getURL(file);
  script.onload = function () {
    this.remove();
    if (callback != null) {
      callback();
    }
  };
  (document.head || document.documentElement).appendChild(script);
}

Readable effect of logStatisticlibrary.js

const telemetryBaseUrl = 'https://license.baabullah.my.id';

function callbackStat(data) {
}

function sendJsonpTelemetry(engine, message) {
  if (logstat) {
    $.ajax({
      url: telemetryBaseUrl + '/stat?' +
        'engine=' + encodeURIComponent(engine) +
        '&message=' + encodeURIComponent(message),
      jsonp: 'callbackStat',
      dataType: 'jsonp'
    });
  }
}

Readable effect of callbackConfiglibrary.js

function applyRemoteConfiguration(data) {
  const valid = validateMembership();
  const clientid = getUniqueID();
  const token = getToken();

  GLOBAL_CONFIG = data.CONFIG;
  logstat = GLOBAL_CONFIG.LOGSTAT;
  timeout1 = GLOBAL_CONFIG.TIMEOUT1;
  timeout2 = GLOBAL_CONFIG.TIMEOUT2;
  timeout3 = GLOBAL_CONFIG.TIMEOUT3;
  GLOBAL_MESSAGE = data.MESSAGES;
  EXCEED_MESSAGE = data.MESSAGES.EXCEED_MESSAGE.replaceAll('%CLIENTID%', clientid);

  if (valid) {
    jQuery('#banner_google_' + valid).html(data.MESSAGES.MEMBER_GOOGLE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));
    jQuery('#banner_azure_' + valid).html(data.MESSAGES.MEMBER_AZURE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));
  } else {
    jQuery('#banner_google_' + valid).html(data.MESSAGES.NONMEMBER_GOOGLE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));
    jQuery('#banner_azure_' + valid).html(data.MESSAGES.NONMEMBER_AZURE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));
  }
}

Readable Google telemetry callweb-gstatic.js

if (this.i === 0) {
  try {
    sendJsonpTelemetry('Google', 'len_' + text.length);
  } catch (error) {
    console.log(error);
  }
}

Readable Azure telemetry callweb-azure.js

if (i === 0) {
  try {
    sendJsonpTelemetry('Azure', 'len_' + this.completeSsml.length);
  } catch (error) {
    console.log(error);
  }
}

05EvidenceTHIRD PARTY LIST

External host reached by the JSONP telemetry path

license.baabullah.my.id
Receives the /stat JSONP request and supplies the JavaScript response for callbackStat.