Is Support for Read&Write Desktop™ safe?
Support for Read&Write Desktop loads remote scripts from toolbar.speechstream.net into visited pages and connects to a local WebSocket for text-to-speech playback.
The extension's content script runs on all pages and, when MathJax v2 is detected, fetches and injects a script from toolbar.speechstream.net without any integrity check, allowing that third-party server to execute code in the page context. A separate Google Docs preloader fetches a remote JSON configuration from texthelp.com CDN to decide which local scripts to load, with no response signature verification. When native messaging is unavailable, the service worker falls back to a plaintext WebSocket connection at ws://localhost:4808 to transmit selected text and text-to-speech payloads.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itEVERWAY OPCO LIMITED - 5 other listings from the same operator, 1 of them carrying a finding
EVERWAY OPCO LIMITED - 5 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 18.0M+ users between them, none of them carrying a finding.
Same operator - 2 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.1.758. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
See the address and title of every tab you have open
tabs
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Where it sends data
Destinations our analysis observed Read&Write Desktop contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 3mc6v8jrwgi9oqvvx7yj56j4.texthelp.com
Read&Write Desktop sends data to 3mc6v8jrwgi9oqvvx7yj56j4.texthelp.com. No other extension we have analysed sends data here.
- toolbar.speechstream.net
Read&Write Desktop sends data to toolbar.speechstream.net. No other extension we have analysed sends data here.