Is Video Translator - Translate Video & Voice online safe?

Medium risk

Video Translator sends your Chrome profile ID to livepolls.app and your email to Alibaba ARMS telemetry.

On startup the extension reads your Chrome profile account info and posts the profile ID to livepolls.app to obtain a login passport token. Its popup and welcome pages also initialise a bundled Alibaba ARMS monitoring SDK that uses your profile email as the user identifier, so error and behaviour beacons sent to arms-retcode.aliyuncs.com carry that email.

livepolls.appv4.8.10Chrome Web Store
45Risk
Who publishes it

livepolls.app - 18 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
livepolls.app
Website
www.livepolls.app/support

Same store account

18 other listings published from this account, 116k+ users between them. 1 of them carries a finding.

Image Translator50k+MediumPDF Translator - Translate PDF online20k+MediumWatermark Remover from Photo | Inpaint10k+CleanAI Video Generator - Create videos from text and images8k+CleanBackground Remover for Images6k+CleanAI Transcription - Transcribe Speech To Text5k+Clean12 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

word.maiyizhi.cn
Also called by 3 other listings, including Voice Translator, YouTube Video Dubbing
optim.tildacdn.pub
Also called by 5 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Chrome profile email is set as the user ID of an Alibaba ARMS monitoring SDK

Code analysis shows the popup reads your Chrome profile email and passes it as the uid to a bundled Alibaba ARMS SDK, which sends image beacons to arms-retcode.aliyuncs.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open the extension popup while signed in to Chrome.

The extension requests the identity and identity.email permissions.

The extension did this

The popup starts a monitoring SDK that identifies you by your profile email.

The SDK reports to arms-retcode.aliyuncs.com.

The code that does this

Where the email is read, cached and handed to the SDK

Readable version

Read the profile account and cache it

assets/background.js-D_eCqAr1.js
function getUserInfo() {  return new Promise(async (resolve) => {    const stored = await chrome.storage.sync.get(["g_user_info"]);    if (stored.g_user_info) resolve(stored.g_user_info);    else chrome.identity.getProfileUserInfo({ accountStatus: "ANY" }, (info) => {      resolve(info);      chrome.storage.sync.set({ g_user_info: info });    });  });}

Start the ARMS SDK with the email as uid

assets/Logger-CTEDOe59.js
async function initLogger() {  const { g_user_info } = await chrome.storage.sync.get(["g_user_info"]);  return ArmsSDK.singleton({    pid: "aa9hucpddy@130c759049da946",    imgUrl: "https://arms-retcode.aliyuncs.com/r.png?",    autoSendPv: false,    behavior: true,    enableConsole: true,    sample: 10,    uid: g_user_info.email  });}
SDK settings relevant to what is reported
  • User ID (uid)
    uid=<profile email address>

    Your Chrome profile email address is used as the SDK user identifier.

  • Beacon endpoint
    https://arms-retcode.aliyuncs.com/r.png?

    Reports are sent as image requests to this Alibaba Cloud host.

  • Sampling
    sample: 10

    Roughly one session in ten reports.

  • Behaviour and console
    behavior: true, enableConsole: true

    The SDK also records user behaviour and console output.

Where the beacons go
    • arms-retcode.aliyuncs.com

    Alibaba Cloud ARMS monitoring endpoint; receives r.png beacons carrying the uid query parameter.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 4.8.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed Video Translator - Translate Video & Voice online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.livepolls.app

    Video Translator - Translate Video & Voice online sends data to www.livepolls.app. 16 other extensions we have analyzed send data here.

  • arms-retcode.aliyuncs.com

    Video Translator - Translate Video & Voice online sends data to arms-retcode.aliyuncs.com. 8 other extensions we have analyzed send data here.

Updated 15 October 2026ofhkcffhkdhjpnpplihikdpkcpailpnc