Is Mate Translate – translator, dictionary safe?
Mate Translate is medium risk. Every 3 days the extension fetches gikken.co settings.json. Its should_register_fullpage_translations flag, now true, records every main-frame URL, batched to translations.matetranslate.com; toggleable server-side, unseen by review.…
Who publishes itGikken UG - no other listings under this identity, 12 shared hostnames
Gikken UG - no other listings under this identity, 12 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 12 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote Server Can Activate URL Tracking Without an Extension Update
Every 3 days the extension fetches gikken.co settings.json.
Its should_register_fullpage_translations flag, now true, records every main-frame URL, batched to translations.matetranslate.com; toggleable server-side, unseen by review.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
The remote settings file at gikken.co/files/mate/settings.json returns `should_register_fullpage_translations: true`.
This flag is currently live. Our dynamic analysis read back this value 13 times from local storage after the initial fetch.
The extension's webRequest listener activates and records the URL of every main-frame page you visit, then batches those records to translations.matetranslate.com.
No extension update is required for this to take effect, the flag change propagates within three days of the next config fetch.
HTTP 200. Body: {"should_register_fullpage_translations": true}. Captured in dynamic analysis as request perf-evt_10, fired at extension startup. This response means URL collection is currently enabled for all users.
- Page URLhttps://en.wikipedia.org/wiki/Translation
The full URL of every main-frame page you load.
- Your user IDa7f3c2e1-84b0-4d2a-b91e-3f8c0d2e1a45
A persistent identifier for your Mate Translate install, stored in chrome.storage as user_id.
- Your countryus
The country code derived from your IP address (see related claim). Included in every batch record as field `c`.
- Referrer URLhttps://www.google.com/search?q=translation+tool
The page you were on before the current one, captured from the request's Referer header.
- Content typetext/html; charset=UTF-8
The MIME type of the page being loaded, taken from the response Content-Type header.
- Timestamp1744640329122
When the page was visited, in milliseconds since epoch.
- Analytics module tagmt-ch
A platform identifier included in every request as the X-Curly-Header and in the payload field `m`.
The remote-config fetch and the URL-collection guard
Settings fetch task — runs every 3 days
// Fetches the remote settings file and stores the flag locally.// Runs every 3 days (Co.THREE_DAYS = 2_592_000_00 ms), keyed on settings_last_update.async function getRemoteMateSettings() { const response = await fetch('https://gikken.co/files/mate/settings.json'); const config = await response.json(); if (config.should_register_fullpage_translations !== undefined) { await storage.setVal('should_register_fullpage_translations', config.should_register_fullpage_translations); // true or false await storage.setIntValue('settings_last_update', Date.now()); }}webRequest handler — fires on every main-frame HTTP response
async function handleWebRequest(requestDetails) { const flagEnabled = await storage.getVal('should_register_fullpage_translations'); const isMainFrame = requestDetails.documentLifecycle === 'active' && requestDetails.type === 'main_frame'; if (flagEnabled && isMainFrame) { const referrer = tempStorage[requestDetails.requestId]?.referrer ?? ''; delete tempStorage[requestDetails.requestId]; const userId = await storage.getVal('user_id'); const country = await storage.getVal('user_country'); await collectAndSendData({ m: analyticsModule, // e.g. 'mt-ch' uid: userId, // persistent install UUID url: requestDetails.url, // full page URL ct: responseContentType, // MIME type from response headers t: Date.now(), // timestamp ms r: referrer, // Referer header value nm: 'request', // navigation mode c: country, // user_country from geo lookup nt: 'foreground' }); }}- gikken.co
Developer's primary domain. Hosts the remote settings file that controls whether URL collection is active.
- translations.matetranslate.com
Receives batched URL records via POST /register_fullpage_translations when the flag is enabled.
Every 3 days
The settings file is re-fetched every 3 days. A flag change on the server takes effect within 3 days for all users without any extension update.
IP Geolocation Lookup Runs at Install and Daily
We captured a GET to api2.matetranslate.com/geo/json seconds after startup, before interaction.
The country-code response is stored and attached to every translation report, plus the uninstall URL.
Runs at install and every 24 hours.
- Severity
- Low unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install Mate Translate, or your browser starts with the extension already installed.
The extension immediately sends a request to api2.matetranslate.com/geo/json to determine your country from your IP address.
No translation action or page visit is needed. The request fires as part of the extension's startup routine and repeats every 24 hours.
HTTP 200. Plain-text body: "us" (or another ISO 3166-1 alpha-2 country code). Captured in dynamic analysis as request perf-evt_4, fired within seconds of extension startup during the chrome.runtime.onInstalled.replay phase.
Your country, derived from your IP, saved here and re-read on every translation request and at uninstall. Persists across restarts.
- Location
- chrome.storage (key: user_country)
us- Country (full-page translation reports)us
Included as field `c` in every batch of page-translation events posted to translations.matetranslate.com.
- Country (sync server selection)cn
Used to choose between sync.matetranslate.com and asia.gikken.co/matesync, your country determines which server stores your data.
- Country (uninstall analytics URL)de
Appended as param c to the URL set via setUninstallURL, sent to sync.matetranslate.com/del_dev when you remove the extension.
The geolocation task as shipped vs. annotated
Annotated version
// Runs once on install and then every 24 hours (Co.DAILY = 864_000_00 ms).// ko() checks 'last_country_fetch_2' in chrome.storage to enforce the interval.async function detectCountry() { const response = await fetch('https://api2.matetranslate.com/geo/json').then(r => r.text()); const country = (response || '').toLowerCase(); if (country && !country.includes('ip address not found')) { await storage.setVal('user_country', country); // e.g. "us" await storage.setIntValue('last_country_fetch_2', Date.now()); }}- api2.matetranslate.com
Primary API server for Mate Translate (Gikken). Receives the geolocation lookup and returns a plain-text country code.
- asia.gikken.co
Regional sync server used for Chinese users (country == 'cn'). Selected based on the stored user_country value.