Is DBird Dual: Live Meeting Translation – Teams, Zoom & Google Meet safe?
DBIRD Dual Subtitles accepts a login token from any web page via its welcome.html page and saves it as the active account.
The extension exposes welcome.html as a web-accessible page reachable from any site, which reads an auth_token URL parameter and forwards it to the background service worker without checking that it came from a real dbird.app login. The background worker stores whatever token it receives as the active DBIRD_token, and the extension then authenticates all dbird.app API calls with that value. The same page also redirects the browser to a URL supplied in a post_login parameter with no allowlist, so it can be used to send the user to an arbitrary destination after showing the welcome screen.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itDBird Apps - no other listings under this identity
DBird Apps - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed DBird Dual: Live Meeting Translation – Teams, Zoom & Google Meet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- dbird.app
DBird Dual: Live Meeting Translation – Teams, Zoom & Google Meet sends data to dbird.app. No other extension we have analyzed sends data here.