Is Zent Translate safe?

Low risk

Zent Translate is low risk. When you use the AI slash-command in Zoho Mail, the content script sends your prompt, page title, and URL to the background worker, which posts them to zenttranslate.com/api/ai-agent/chat. These can describe the mailbox thread or folder.

zenttranslatev5.3.6Chrome Web Store
20Risk
Who publishes it

zenttranslate - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
zenttranslate

Same store account

1 other listing published from this account, 20k+ users between them, none of them carrying a finding.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

agtranslate.com
Also called by 1 other listing: Translate in Side Panel
zenttranslate.com
Also called by 3 other listings, including Translate in Side Panel

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Zoho Mail slash command sends email page context

When you use the AI slash-command in Zoho Mail, the content script sends your prompt, page title, and URL to the background worker, which posts them to zenttranslate.com/api/ai-agent/chat.

These can describe the mailbox thread or folder.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You invoke the AI slash-command feature while on Zoho Mail.

The extension did this

The extension sends your typed prompt together with the page title and page URL to Zent Translate.

Those page fields can identify the mailbox view, folder, thread, or subject visible in the tab.

Fields constructed for the slash-command request
  • Typed prompt
    /summarize this renewal email

    Contains the text you entered for the AI slash command.

  • Email page URL
    https://mail.zoho.com/zm/#mail/folder/inbox/p/1699483512457000001

    Can reveal which Zoho Mail view or message thread was open when you used the command.

  • Email page title
    Inbox - Project status update - Zoho Mail

    Can include the mailbox folder or subject text visible in the browser tab.

  • Request mode
    slash-command

    Marks the request as coming from the slash-command feature.

Captured request
POSThttps://www.zenttranslate.com/api/ai-agent/chat
Headers
Content-Type
application/json
The code that does this

Zoho Mail content script and background fetch path

Readable version

Readable doAiChat() sends typed text, title, and URL to the background port

content-scripts/slash-command-iframe.js
    async doAiChat(a, r, l) {      this.aiAbortController?.abort(), this.aiAbortController = new AbortController, this.updateState({        isActive: !0,        command: r,        targetLanguage: il,        query: a,        position: l,        isLoading: !0,        error: null,        result: null,        candidates: [],        selectedIndex: 0,        isAiCommand: !0,        aiResponse: ""      });      try {        const s = chrome.runtime.connect({          name: "ai-slash-chat"        });        let f = "";        const p = this.aiAbortController.signal;        await new Promise((h, g) => {          const y = () => {            s.disconnect(), g(new Error("aborted"))          };          p.addEventListener("abort", y, {            once: !0          }), s.onMessage.addListener(T => {            T.type === "chunk" ? (f += T.text, this.currentTrigger?.query === a && this.updateState({              isLoading: !1,              aiResponse: f            })) : T.type === "done" ? (p.removeEventListener("abort", y), h()) : T.type === "error" && (p.removeEventListener("abort", y), g(new Error(T.error || "AI request failed")))          }), s.onDisconnect.addListener(() => {            p.removeEventListener("abort", y), f ? h() : g(new Error("Connection lost"))          }), s.postMessage({            messages: [{              role: "user",              content: a            }],            pageTitle: document.title,            pageUrl: location.href          })        }), this.currentTrigger?.query === a && this.updateState({          isLoading: !1,          aiResponse: f        }), ws(_s.SLASH_COMMAND_USED, {          command: r,          target_language: "ai",          input_type: "ai-chat",          char_count: a.length,          hostname: location.hostname        })      } catch (s) {        if (s.message === "aborted" || this.currentTrigger?.query !== a) return;        let f = s.message || "AI request failed";        s.message === "unauthorized" ? f = "Please login to use AI" : s.message === "quota_exceeded" && (f = "Daily AI limit reached"), this.updateState({          isLoading: !1,          error: f        })      }    }

Readable background listener posts the fields to Zent Translate

background.js
    }), chrome.runtime.onConnect.addListener(h => {      h.name === "ai-slash-chat" && h.onMessage.addListener(async w => {        try {          const O = await fetch(`${a}/api/ai-agent/chat`, {            method: "POST",            headers: {              "Content-Type": "application/json"            },            credentials: "include",            body: JSON.stringify({              messages: w.messages,              pageTitle: w.pageTitle,              pageUrl: w.pageUrl,              mode: "slash-command"            })          });          if (!O.ok) {            const P = await O.json().catch(() => ({}));            O.status === 401 ? h.postMessage({              type: "error",              error: "unauthorized"            }) : O.status === 429 && P.error === "quota_exceeded" ? h.postMessage({              type: "error",              error: "quota_exceeded"            }) : h.postMessage({              type: "error",              error: P.error || `Request failed (${O.status})`            });            return          }          if (!O.body) {            h.postMessage({              type: "error",              error: "No response body"            });            return          }          const N = O.body.getReader(),            L = new TextDecoder;
External host receiving the slash-command request
    • www.zenttranslate.com

    Receives the AI slash-command POST containing typed prompt text plus Zoho Mail page title and URL.

Updated 30 September 2026bincmiainjofjnhchmcalkanjebghoen