Is Quick Translate: Reading & writing translator safe?

Medium risk

Quick Translate sends shopping cart and checkout page URLs to charitypartners.net after its donation prompt is clicked.

On Amazon, AliExpress, and Booking cart or checkout pages, a content script renders a donation prompt. If the user chooses Support Extension or Help Safe Animals, the background worker posts the current tab URL to charitypartners.net and opens the returned link in a pinned inactive tab for about 15 seconds.

toanrittnisv1.0.5Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Shopping donation prompt sends cart URLs to charitypartners.net

On supported shopping cart or checkout pages, the extension can show a donation prompt.

Clicking it sends the active tab URL to charitypartners.net and opens the returned affiliate URL in a pinned, inactive tab for a short time.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

The user clicks the shopping donation prompt.

The extension did this

The extension sends the active shopping tab URL to charitypartners.net and opens the returned affiliate URL in a pinned inactive tab.

Captured request
POSThttp://charitypartners.net/api
Fields in the request
  • Shopping page URL
    https://www.amazon.com/gp/cart/view.html (illustrative)

    Shows the cart, checkout, reservation, or payment page that was active when the prompt was clicked.

  • Active tab context
    amazon.com (illustrative)

    Links the request to the current tab and lets the extension record the related hostname timestamp locally.

Observation

Dynamic analysis confirmed the content script injection, the click-triggered DONATE message, the POST to charitypartners.net/api, and the pinned inactive tab opened from the returned URL.

What it can do

Permissions this extension asks for, as declared in version 1.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Read information about your displays

    system.display

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed Translator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • charitypartners.net

    Translator sends data to charitypartners.net. No other extension we have analysed sends data here.

Updated 30 September 2026gpdfpljioapjogbnlpmganakfjcemifk