Is DualPiP – PiP Player | ASR Live Captions · Subtitles & AI Translation safe?

Medium risk

DualPiP exposes a cross-extension fetch proxy that can send requested URLs, headers, and page content to any installed extension.

The extension allows external messages from any installed extension and forwards caller-controlled HTTP requests through its background service worker. Because it also has access to all URLs, another extension can ask it to fetch a URL and receive response details such as headers, status, and returned page content.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

RabbitPairv1.9.3Chrome Web Store
40Risk
Who publishes it

RabbitPair - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

1 other listing published from this account, 292 users between them, none of them carrying a finding.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.subdl.com
Also called by 1 other listing: subtilt%C3%A9e-netflix-youtube
dl.subdl.com
Also called by 1 other listing: subtilt%C3%A9e-netflix-youtube

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed DualPiP contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • any installed extension

    DualPiP sends data to any installed extension. Named as a recipient in this extension's own analysis.

Updated 30 September 2026ddkmobcljbfggkmibabekgpbighaogpn