Is Language Learning with Netflix & YouTube-AFL safe?
Language Learning with Netflix & YouTube sends subtitle text, viewing metadata, and your email to its appforlanguage.com servers.
When you use the AI Coach feature, the extension uploads the full subtitle (VTT) file of the Netflix or YouTube video you are watching, along with the movie ID and language, to words.appforlanguage.com. It also reports per-video metadata (movie ID, dubbing and subtitle status) to m.appforlanguage.com on each Netflix load, and pre-fills its uninstall feedback URL with your email and last-watched video link. Separately it sends usage events to Google Analytics with a persistent random client ID, but those analytics payloads do not include your browsing URLs or personal details.
Who publishes itApp For Language - 4 other listings from the same operator, 2 of them carrying a finding
App For Language - 4 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 18k+ users between them. 2 of them carry a finding.
Shared hosts - 13 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Netflix subtitles sent to AI chat ingest
Starting Netflix AI chat with a signed-in account reads the subtitle VTT file, sends it to words.appforlanguage.com with movie ID and language, plus a token as Authorization when present.
Testing without those gates never reached it.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open the AI chat feature while watching Netflix with subtitles available.
The code checks for sign-in, a gold or platinum plan, and permission to contact the AI chat host before continuing.
The extension sends the current subtitle file and video context to its AI chat ingest service.
The payload contains the movie identifier, subtitle language, and VTT subtitle text.
- Movie identifier81234567
This identifies which Netflix title the AI chat request is about.
- Subtitle languageen
This tells the service which subtitle track was active for the video.
- Subtitle file textWEBVTT 00:00:01.000 --> 00:00:03.000 Welcome back
This is the readable dialogue text from the subtitle track you were using.
The shipped code sends this request before starting the /ask/stream request when an ingest payload is present.
Netflix script hands subtitle VTT to the AI chat stream
Readable handoff to streamAskWithIngest
deobfuscated/netflix/contentscript.jskey: "streamAskWithIngest",value: function(e, a) { return M(function(e, a) { var r = arguments.length > 2 && void 0 !== arguments[2] ? arguments[2] : {}; return u().m(function n() { return u().w(function(n) { for (;;) switch (n.n) { case 0: return n.d(c(H(V(t.streamAskWithOptionalIngest(e, { movie_id: e.movie_id, subtitle_vtt: a, subtitle_language: e.subtitle_language }, r)))), 1); case 1: return n.a(2) } }, n) })() }).apply(this, arguments)}Readable port message to the background service worker
deobfuscated/netflix/contentscript.jso.postMessage({ type: b.MessageType.NF_STREAM_ASK_START, body: t, opts: { token: a.token, accept: null !== (n = a.accept) && void 0 !== n ? n : "text/event-stream" }, ingest: e})Background service worker posts the ingest payload
Readable POST to /ingest
deobfuscated/backgroundscript.jsreturn o.n = 2, fetch("".concat(d, "/ingest"), { method: "POST", headers: c({ "Content-Type": "application/json" }, null != f && f.token ? { Authorization: "Bearer ".concat(f.token) } : {}), body: JSON.stringify({ movie_id: p.movie_id, subtitle_language: p.subtitle_language, subtitle_vtt: p.subtitle_vtt }), signal: r.signal});Readable AI chat base URL
deobfuscated/backgroundscript.jst.aiChatBaseURL = "https://words.appforlanguage.com/ai_movie_chat_bot"- words.appforlanguage.com
Receives the AI chat ingest POST containing Netflix movie context and subtitle text.
Where it sends data
Destinations our analysis observed Language Learning with Netflix contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Language Learning with Netflix sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- appforlanguage.com
Language Learning with Netflix sends data to appforlanguage.com. 2 other extensions we have analysed send data here.
- m.appforlanguage.com
Language Learning with Netflix sends data to m.appforlanguage.com. No other extension we have analysed sends data here.
- words.appforlanguage.com
Language Learning with Netflix sends data to words.appforlanguage.com. No other extension we have analysed sends data here.