Is Real-time Video Translator & Dubbing - DubTab safe?

Clean risk

Real-time Video Translator & Dubbing - DubTab sends Firebase ID tokens in SonicCaption WebSocket and voice-list URLs.

When translation starts or the voice list loads, the extension adds the user's Firebase ID token to request URLs for SonicCaption's realtime and voices endpoints. On Google login, it also identifies the user to PostHog with Google/Firebase identifiers including uid, email, display name, and user level.

XTCodeTechv1.2.0Chrome Web Store
0Risk
Who publishes it

XTCodeTech - 8 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
XTCodeTech
Website
dubtab.com/contact

Same store account

8 other listings published from this account, 19k+ users between them, none of them carrying a finding.

Real-Time Bilingual Video & Audio Translation – SonicCaption6k+CleanTwFollowExporter - export Twitter followers4k+LowTwExtract - export anyone's tweets to CSV3k+CleanLive Captions & Translation for Google Meet, Zoom and MS Teams2k+LowTweets2PDF - Convert All Tweets to One PDF/EPUB1k+CleanTwListExport - export Twitter/X List followers and members1k+Clean2 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on cloudfunctions.net

    https://*.cloudfunctions.net/*

  • Read and change your data on soniccaption.com

    https://*.soniccaption.com/*

  • Read and change your data on posthog.com

    https://*.posthog.com/*

  • Read and change your data on firebaseapp.com

    https://*.firebaseapp.com/*

  • Read and change your data on dubtab.com

    https://*.dubtab.com/*

  • Read and change your data on r2.dev

    https://*.r2.dev/*

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • Capture the video and audio of a tab

    tabCapture

  • Run hidden pages in the background

    offscreen

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Real-time Video Translator & Dubbing - DubTab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • us.i.posthog.com

    Real-time Video Translator & Dubbing - DubTab sends data to us.i.posthog.com. 24 other extensions we have analysed send data here.

  • ws3.soniccaption.com

    Real-time Video Translator & Dubbing - DubTab sends data to ws3.soniccaption.com. No other extension we have analysed sends data here.

Updated 30 September 2026eckchpcahbgbkngandbmcdpdokeoojbf