Is English Popup Dictionary safe?

Medium risk

English Popup Dictionary sends selected words, page URLs, IP addresses, and user agents to advertising services during lookups.

When you double-click a single word on any website, the extension runs a dictionary lookup and then checks your public IP address for geolocation. For US users, it sends the selected word, current page URL, IP address, and browser user agent to an AdMedia HTTP endpoint to fetch ads for the popup.

krv5vigneshv1.9Firefox Add-ons
45Risk
Who publishes it

krv5vignesh - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
krv5vignesh
Website
krv5vignesh.github.io/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Selected text and page details sent to AdMedia during dictionary lookups

Double-clicking a word for lookup makes English Popup Dictionary send the selected text, page URL, IP address, and user agent to xml.admedia.com/xml.php.

Confirmed by recorded mechanism and verification rows for that request.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user double-clicks a word on a page.

The extension did this

The extension sends the selected word, page URL, IP address, and user agent to an AdMedia ad endpoint during the dictionary lookup.

Captured request
GETxml.admedia.com/xml.php
Fields in the request
  • Selected page text
    example

    The word you selected for the dictionary lookup is sent as ad request context.

  • Current page URL
    https://example.com/article

    The address of the page where you selected the word can reveal browsing context.

  • IP address
    203.0.113.42

    The request includes the user's network address, which can identify location and network context.

  • Browser user agent
    Mozilla/5.0 (X11; Linux x86_64) Chrome/126.0.0.0

    The browser and device string helps characterize the browsing environment.

Observation

The verification row confirms the all-page content script match, the double-click trigger, and the request fields sent to the AdMedia endpoint.

What it can do

Permissions this extension asks for, as declared in version 1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.dictionaryapi.dev

    https://api.dictionaryapi.dev/api/

  • Read and change your data on xml.admedia.com

    http://xml.admedia.com/

  • Read and change your data on api.ipify.org

    https://api.ipify.org/

  • Read and change your data on api.ipstack.com

    http://api.ipstack.com/

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed English Popup Dictionary contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.ipify.orgwidely used

    English Popup Dictionary sends data to api.ipify.org. A widely used service: 41 other extensions we have analysed send data here.

  • api.ipstack.com

    English Popup Dictionary sends data to api.ipstack.com. One other extension we have analysed sends data here.

  • xml.admedia.com

    English Popup Dictionary sends data to xml.admedia.com. No other extension we have analysed sends data here.

Updated 30 September 2026amo-896450