Is Itzuli+ safe?

Medium risk

Itzuli+ sends selected text and microphone recordings from any web page to Basque Government translation APIs.

When a user selects text on any page or triggers voice input, the extension captures that content and transmits it to api.euskadi.eus for translation, speech recognition, and language detection. Audio is recorded for up to 5 seconds, base64-encoded, and posted to the same API endpoint. The extension also embeds hardcoded API credentials in its background script that are sent with every translation request.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Eusko Jaurlaritza - Gobierno Vascov3.10Chrome Web Store
42Risk
Who publishes it

EJIE - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Eusko Jaurlaritza - Gobierno Vasco
Declared legal entity
EJIE
Registered address
Avenida Mediterraneo 14, Avenida Mediterraneo 14, Vitoria-Gasteiz, Álava 01010, ES
Registered contact
Oscar Guadilla

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/* and 1 more

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on developer.mozilla.org

    *://developer.mozilla.org/*

  • Add items to the right-click menu

    contextMenus

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Itzuli+ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.euskadi.eus

    Itzuli+ sends data to api.euskadi.eus. No other extension we have analysed sends data here.

  • www.euskaltzaindia.eus

    Itzuli+ sends data to www.euskaltzaindia.eus. No other extension we have analysed sends data here.

Updated 30 September 2026bafhgiajedliopeidkhgidpbjejkfnlm