Is Choose All Languages safe?

Medium risk

Tabblar redirects visits to 14 brand sites to the developer's referral links, once per 24 hours per site.

A content script runs on every http(s) page and, when the hostname matches a built-in list (Amazon, PayPal, Rakuten, Honey, NordVPN and others), sets the page location to the developer's affiliate URL. It repeats this at most once every 24 hours per site and the code shows no user-facing setting for it, only a hidden query parameter that blocks it. The code does not send page URLs or user data to a vendor server.

Anaya Woodsv1.0.0Chrome Web Store
55Risk
Who publishes it

Anaya Woods - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Anaya Woods
Website
choosealllanguages.com/

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

errors.net
Also called by 2 other listings: Browse Better Today, Errors.net official extension
powerthesaurus.org
Also called by 6 other listings, including Power Thesaurus, Language Tools - Translate, Dictionary, and Thesaurus, Power Thesaurus

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Errors.net library reports each page URL and a persistent ID on every page load

Code analysis shows every page you load is reported to errors.net with a persistent ID, the page URL and window size.

The content script runs on all sites.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You load any web page.

The extension did this

The extension sends the page address, load timings and window size to errors.net, tagged with a persistent ID.

Fields in the report body
  • Persistent ID
    3f9a1c7e5b2d4a80b6e1c9d47a3f2e15

    A random ID stored in sync storage, so visits can be linked over time.

  • Page address
    https://example.com/account/orders?id=1042

    The navigation timing name field holds the full URL of the page.

  • Window geometry
    ow 1440, oh 900, iw 1425, ih 812

    Screen position and inner and outer window sizes.

  • Load timings
    duration 1243.7 ms

    Timing of each stage of the page load.

The code that does this

Content script collection and service worker upload

Readable version

Collection

performance.js
const timing = performance.getEntriesByType('navigation')[0].toJSON(); // timing.name is the page URLchrome.runtime.sendMessage({ time, timing, dimensions });

Upload

sw.js
const { uuid } = await chrome.storage.sync.get('uuid');const reply = await perf({ uuid, performance: timing, dimensions });// perf() POSTs JSON to https://errors.net/performance/?license=<apikey>
Destination
    • errors.net

    Receives the per-page report; the license query parameter is a hardcoded key.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Errors.net replies can open tabs or windows and redirect failed page loads

Code analysis shows errors.net can reply with a tab or window to open, with no checks.

Pages that return 4xx or 5xx, or fail DNS, are also sent to errors.net with the URL.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

errors.net answers the per-page report with a notice or alert object.

The extension did this

The extension opens a tab or window using the properties the server supplied, including the URL.

The code that does this

Server-driven tabs and error-page redirects

Readable version

Reply handling

sw.js
if (reply?.notice) chrome.tabs.create(reply.notice);else if (reply?.alert) chrome.windows.create(reply.alert);

Error handling

sw.js
// main_frame response with status 4xx or 5xx, hostname not in last 5 handled:chrome.tabs.create({ url: 'https://errors.net/error/?errorurl=' + url + '&error=' + status + '&uuid=' + uuid });chrome.tabs.remove(tabId);// main_frame RESOLVE error: tabs.update to the same errors.net/error/ URL with error=nx
What the error redirect carries
  • Failed page address
    https://shop.example.org/cart/checkout?session=8841

    The full URL of the page that failed is placed in the errors.net address.

  • Persistent ID
    3f9a1c7e5b2d4a80b6e1c9d47a3f2e15

    The same stored UUID is added to the address.

  • Error type
    404

    The HTTP status code, or nx for a DNS failure.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Choose All Languages contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.rakuten.com

    Choose All Languages sends data to www.rakuten.com. 4 other extensions we have analysed send data here.

  • giftly.app

    Choose All Languages sends data to giftly.app. 3 other extensions we have analysed send data here.

  • r.honeygain.me

    Choose All Languages sends data to r.honeygain.me. 3 other extensions we have analysed send data here.

  • ref.nordvpn.com

    Choose All Languages sends data to ref.nordvpn.com. 3 other extensions we have analysed send data here.

  • www.joinhoney.com

    Choose All Languages sends data to www.joinhoney.com. 3 other extensions we have analysed send data here.

  • py.pl

    Choose All Languages sends data to py.pl. 2 other extensions we have analysed send data here.

Updated 15 October 2026mjnkponkkeiiicfjemgpcncnbfnfjghi