Google TranslateSecurity Analysis

Uses eval() to execute dynamic code, a common technique for obfuscation and code injection.

Dynamically creates script elements, potentially loading external malicious code.

Uses eval() to execute dynamic code — a common vector for code injection.

Decodes base64 data, commonly used to hide malicious payloads.

Uses XMLHttpRequest to make network calls.

JavaScript file could not be parsed and has high entropy. May contain obfuscated code.

This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.

Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.

Content script matches <all_urls>, executing on every website the user visits.

Encodes data to base64, may be used for data exfiltration.

String with entropy 5.95 bits — may be encoded/encrypted data