Is YouTube Translator & YouTube Video Dubbing safe?

Medium risk

YouTube Translator is medium risk. Dynamic analysis captured this extension reading your signed-in Google email and storing it in synced storage. The email is passed as user ID to Alibaba's ARMS SDK, sent to arms-retcode.aliyuncs.com when YouTube translation runs.

livepolls.appv2.6.5Chrome Web Store
45Risk
Who publishes it

livepolls.app - 4 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
livepolls.app
Website
www.transmonkey.ai/support

Same store account

4 other listings published from this account, 6k+ users between them, none of them carrying a finding.

AI Code Generator3k+LowText to Speech - AI Voice Generator & TTS1k+MediumOSINT Username Search1k+LowHTML to Figma — Import Webpages to Figma1k+Clean

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

log.aibabygenerator.io
Also called by 1 other listing: Image Translator

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Google account email sent to Alibaba telemetry as user identifier

Dynamic analysis captured this extension reading your signed-in Google email and storing it in synced storage.

The email is passed as user ID to Alibaba's ARMS SDK, sent to arms-retcode.aliyuncs.com when YouTube translation runs.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open YouTube while signed in to Chrome.

The extension's content script runs on every https://www.youtube.com/* page load.

The extension did this

The extension reads your Google account email via the Chrome identity API and stores it in synced browser storage.

Your email address and Google account ID are then forwarded to the Alibaba ARMS telemetry SDK, which beacons them to arms-retcode.aliyuncs.com.

The code that does this

Service worker reads Google account email and stores it

Readable version

The email field from getProfileUserInfo contains the user's Google account email address

assets/content-BYMqMFM4.js
// chrome.identity.getProfileUserInfo returns: { email: "user@gmail.com", id: "123456789" }// Both fields are cached to chrome.storage.sync['g_user_info'] and persist across sessions.// The email is later extracted by the content script:const e = await chrome.runtime.sendMessage({ type: 'get_user', cacheOnly: i });window.__bl = this.initBrowserLogger(e?.email);  // email → ARMS uid
The code that does this

Email passed as uid to Alibaba ARMS SDK

Readable version

R is the Alibaba ARMS BrowserLogger class (imported from index-tg6_j7aN.js). The uid field is defined at line 8268 of that bundle as a top-level config param included in every outbound beacon.

assets/index-tg6_j7aN.js
// From index-tg6_j7aN.js (the bundled ARMS SDK):// defaultImgUrl: "https://arms-retcode.aliyuncs.com/r.png?"// uid: null   ← populated with the user's Google email on init//// Every PV/event beacon includes uid in the query string:// https://arms-retcode.aliyuncs.com/r.png?pid=aa9hucpddy%4079ec3669add08dc&uid=user%40gmail.com&...
What's stored on your device

Captured during a test session. The email and account ID persist in synced storage across every Chrome device signed in to the same account.

Location
chrome.storage.sync key 'g_user_info'
Contents
{  "id": "114302981776543210987",  "email": "robertfinwitch@gmail.com"}
Third-party destinations receiving the Google account email
    • arms-retcode.aliyuncs.com

    Alibaba Cloud ARMS (Application Real-Time Monitoring Service) browser telemetry. Receives your Google account email as the uid session identifier in every monitoring beacon.

    • www.livepolls.app

    Extension developer's own backend. Receives your Google UID (not email) via POST to /youtube_translation/api/user/passport and /api/user/status for account management.

What it can do

Permissions this extension asks for, as declared in version 2.5.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 2.6.5, which we have not unpacked yet.

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Updated 30 September 2026ndbhldoclidahhoogmgklimmomnnepjg