Is Disney Plus Subtitle Translator - Dual Subtitles safe?

High risk

Disney Plus Subtitle Translator - Dual Subtitles sends subtitle text, page context, and runtime/storage events to Amplitude.

When subtitle translation runs, the background script includes the subtitle text, source and target languages, tab URL, and tab title in requests to the extension's backend. The same runtime message details, translated responses, and storage changes are wrapped into Amplitude events sent to api2.amplitude.com/2/httpapi.

DisneyPlusSubtitleTranslatorv2.17.0Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every background message and storage change is logged to Amplitude analytics

The background script forwards every runtime message and storage change into Amplitude analytics under a hardcoded project key.

We planted a subtitle-language setting and watched it leave verbatim.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You change a setting, request your account status, or ask the extension to translate a subtitle line.

Each of these sends a runtime message from the content script or popup to the background service worker.

The extension did this

The background script logs the entire incoming message, plus any local storage change, to Amplitude before it does anything else with it.

The field it logs is the whole message object, so a translate command's payload, including the subtitle text being translated, is included by the same code path.

Captured request
POSThttps://api2.amplitude.com/2/httpapi
Headers
Content-Type
application/json
Body
{  "api_key": "71c94e6a2d09375a9f3ef06ed0d115ab",  "events": [    {      "event_type": "Background Storage Change",      "event_properties": {        "namespace": "local",        "key": "setting",        "oldValue": {          "lang_1": ""        },        "newValue": {          "lang_1": "de"        }      }    }  ]}
Captured request
POSThttps://api2.amplitude.com/2/httpapi
Headers
Content-Type
application/json
Body
{  "api_key": "71c94e6a2d09375a9f3ef06ed0d115ab",  "events": [    {      "event_type": "Background Runtime Message",      "event_properties": {        "status": "begin",        "cmd": "account",        "req": {          "cmd": "account",          "payload": {            "cmd": "getinfo"          }        }      }    },    {      "event_type": "Background Storage Change",      "event_properties": {        "namespace": "local",        "key": "account_info"      }    }  ]}
The code that does this

The two listeners that log every message and storage change before doing anything else with them

Readable version

Storage change listener, readable

background.js (beautified line 8977)
chrome.storage.onChanged.addListener(function (changes, namespace) {  for (const [key, { oldValue, newValue }] of Object.entries(changes)) {    // Nn(eventName, properties) wraps Amplitude's track() call    Nn("Background Storage Change", {      extname: f.ext.name,      namespace: namespace,      key: key,      oldValue: oldValue,      newValue: newValue    });  }});

Runtime message listener, readable (first three command branches)

background.js (beautified line 8992)
chrome.runtime.onMessage.addListener(function (req, sender, sendResponse) {  // Logged BEFORE any command handling below, so a translate command's  // payload.q (the subtitle text) travels through this same call.  Nn("Background Runtime Message", {    extname: f.ext.name,    status: "begin",    cmd: req.cmd,    req: req  });  if (req.cmd === "translate") return Dn(req, sender, sendResponse), true;  if (req.cmd === "usage")     return Bn(req, sender, sendResponse), true;  if (req.cmd === "account")   return Kn(req, sender, sendResponse), true;
What the logged message and storage objects can carry, by command
  • Selected subtitle language
    lang_1: "de"

    The subtitle language you pick in the popup is written to storage, and every storage write is logged to Amplitude.

  • Account status response
    {"cmd":"account","payload":{"cmd":"getinfo"}}

    Your account command and its cached response key are logged in full when you check your account status.

  • Session data from your account page
    {"email":"user@example.com","cusId":"cus_8f2b1e77a4"} (illustrative shape, field names as declared in code)

    The extension's own website writes your logged-in session object into local storage, and every change there is logged the same way.

  • Subtitle text you're translating
    payload.q: (illustrative, not captured; code path confirmed statically)

    Code analysis shows this same logging call also carries a translate command's subtitle text. Not triggered in our test session.

Third-party destinations
    • api2.amplitude.com

    Receives every logged runtime message and storage change as analytics events. A third-party product-analytics vendor, unrelated to Disney or the translation backend.

What it can do

Permissions this extension asks for, as declared in version 2.16.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 2.17.0, which we have not unpacked yet.

  • Read and change your data on disneyplus-subtitle-translator.com

    https://*.disneyplus-subtitle-translator.com/*

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed Disney Plus Subtitle Translator - Dual Subtitles contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api2.amplitude.comwidely used

    Disney Plus Subtitle Translator - Dual Subtitles sends data to api2.amplitude.com. A widely used service: 41 other extensions we have analysed send data here.

  • api.disneyplus-subtitle-translator.com

    Disney Plus Subtitle Translator - Dual Subtitles sends data to api.disneyplus-subtitle-translator.com. No other extension we have analysed sends data here.

Updated 30 September 2026ojhgmkdbdcgmgcioandnlaabnhofbnel