Is Zent Translate safe?
Zent Translate is low risk. When you use the AI slash-command in Zoho Mail, the content script sends your prompt, page title, and URL to the background worker, which posts them to zenttranslate.com/api/ai-agent/chat. These can describe the mailbox thread or folder.
Who publishes itzenttranslate - 1 other listing from the same operator, none carrying a finding
zenttranslate - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 20k+ users between them, none of them carrying a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Zoho Mail slash command sends email page context
When you use the AI slash-command in Zoho Mail, the content script sends your prompt, page title, and URL to the background worker, which posts them to zenttranslate.com/api/ai-agent/chat.
These can describe the mailbox thread or folder.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You invoke the AI slash-command feature while on Zoho Mail.
The extension sends your typed prompt together with the page title and page URL to Zent Translate.
Those page fields can identify the mailbox view, folder, thread, or subject visible in the tab.
- Typed prompt/summarize this renewal email
Contains the text you entered for the AI slash command.
- Email page URLhttps://mail.zoho.com/zm/#mail/folder/inbox/p/1699483512457000001
Can reveal which Zoho Mail view or message thread was open when you used the command.
- Email page titleInbox - Project status update - Zoho Mail
Can include the mailbox folder or subject text visible in the browser tab.
- Request modeslash-command
Marks the request as coming from the slash-command feature.
- Content-Type
- application/json
Zoho Mail content script and background fetch path
Readable doAiChat() sends typed text, title, and URL to the background port
content-scripts/slash-command-iframe.js async doAiChat(a, r, l) { this.aiAbortController?.abort(), this.aiAbortController = new AbortController, this.updateState({ isActive: !0, command: r, targetLanguage: il, query: a, position: l, isLoading: !0, error: null, result: null, candidates: [], selectedIndex: 0, isAiCommand: !0, aiResponse: "" }); try { const s = chrome.runtime.connect({ name: "ai-slash-chat" }); let f = ""; const p = this.aiAbortController.signal; await new Promise((h, g) => { const y = () => { s.disconnect(), g(new Error("aborted")) }; p.addEventListener("abort", y, { once: !0 }), s.onMessage.addListener(T => { T.type === "chunk" ? (f += T.text, this.currentTrigger?.query === a && this.updateState({ isLoading: !1, aiResponse: f })) : T.type === "done" ? (p.removeEventListener("abort", y), h()) : T.type === "error" && (p.removeEventListener("abort", y), g(new Error(T.error || "AI request failed"))) }), s.onDisconnect.addListener(() => { p.removeEventListener("abort", y), f ? h() : g(new Error("Connection lost")) }), s.postMessage({ messages: [{ role: "user", content: a }], pageTitle: document.title, pageUrl: location.href }) }), this.currentTrigger?.query === a && this.updateState({ isLoading: !1, aiResponse: f }), ws(_s.SLASH_COMMAND_USED, { command: r, target_language: "ai", input_type: "ai-chat", char_count: a.length, hostname: location.hostname }) } catch (s) { if (s.message === "aborted" || this.currentTrigger?.query !== a) return; let f = s.message || "AI request failed"; s.message === "unauthorized" ? f = "Please login to use AI" : s.message === "quota_exceeded" && (f = "Daily AI limit reached"), this.updateState({ isLoading: !1, error: f }) } }Readable background listener posts the fields to Zent Translate
background.js }), chrome.runtime.onConnect.addListener(h => { h.name === "ai-slash-chat" && h.onMessage.addListener(async w => { try { const O = await fetch(`${a}/api/ai-agent/chat`, { method: "POST", headers: { "Content-Type": "application/json" }, credentials: "include", body: JSON.stringify({ messages: w.messages, pageTitle: w.pageTitle, pageUrl: w.pageUrl, mode: "slash-command" }) }); if (!O.ok) { const P = await O.json().catch(() => ({})); O.status === 401 ? h.postMessage({ type: "error", error: "unauthorized" }) : O.status === 429 && P.error === "quota_exceeded" ? h.postMessage({ type: "error", error: "quota_exceeded" }) : h.postMessage({ type: "error", error: P.error || `Request failed (${O.status})` }); return } if (!O.body) { h.postMessage({ type: "error", error: "No response body" }); return } const N = O.body.getReader(), L = new TextDecoder;- www.zenttranslate.com
Receives the AI slash-command POST containing typed prompt text plus Zoho Mail page title and URL.
What it can do
Permissions this extension asks for, as declared in version 5.3.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on translate.googleapis.com
https://translate.googleapis.com/*
Read and change your data on translate.google.com
https://translate.google.com/*
Read and change your data on translate-pa.googleapis.com
https://translate-pa.googleapis.com/*
Read and change your data on edge.microsoft.com
https://edge.microsoft.com/*
Read and change your data on api-edge.cognitive.microsofttranslator.com
https://api-edge.cognitive.microsofttranslator.com/*
Read and change your data on bing.com
https://*.bing.com/* and 1 more
Read and change your data on www.bing.com
https://www.bing.com/*
Read and change your data on fanyi.baidu.com
https://fanyi.baidu.com/*
Read and change your data on www.deepl.com
https://www.deepl.com/*
Read and change your data on www.zenttranslate.com
https://www.zenttranslate.com/*
Read and change your data on agtranslate.com
https://agtranslate.com/*
Read and change your data on dict.youdao.com
https://dict.youdao.com/*
Store data in your browser
storage
Show a panel beside the page
sidePanel
Add items to the right-click menu
contextMenus
Block and redirect the requests your browser makes
declarativeNetRequest
Run its own code inside the pages you visit
scripting
Act on the current tab, but only after you click the extension
activeTab
Speak text aloud
tts