Is CaptionGo – Bilingual Subtitles & AI Live Captions for Any Video safe?
CaptionGo forges Referer, Origin, and User-Agent headers to impersonate DeepL, Tencent, ByteDance, and Microsoft's own translation apps.
When CaptionGo sends the text it captions or translates to DeepL, Tencent TranSmart, ByteDance Volcengine, and Microsoft's Edge Translate, it rewrites the request headers so the traffic looks like it came from each vendor's own official web or app client (or, in DeepL's case, a different, unrelated extension's ID) rather than from CaptionGo itself. This bypasses the origin checks those vendors use to gate their internal translation APIs to authorized clients. Separately, the extension attaches an undisclosed tracking header to any request matching a small set of unrelated domains, and forces permissive CORS headers on responses from filegasm.com for any website's own scripts.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itRabbitPair - 1 other listing from the same operator, 1 of them carrying a finding
RabbitPair - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 10k+ users between them. 1 of them carries a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed captiongo-–-bilingual-sub contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- edge.microsoft.com
captiongo-–-bilingual-sub sends data to edge.microsoft.com. 8 other extensions we have analysed send data here.
- transmart.qq.com
captiongo-–-bilingual-sub sends data to transmart.qq.com. 7 other extensions we have analysed send data here.
- translate.volcengine.com
captiongo-–-bilingual-sub sends data to translate.volcengine.com. 6 other extensions we have analysed send data here.
- api.deepl.com
captiongo-–-bilingual-sub sends data to api.deepl.com. 5 other extensions we have analysed send data here.
- www2.deepl.com
captiongo-–-bilingual-sub sends data to www2.deepl.com. 2 other extensions we have analysed send data here.
- filegasm.com
captiongo-–-bilingual-sub sends data to filegasm.com. No other extension we have analysed sends data here.