Edge Translate - Browser Translator | PDF Translation | MV3 | Open Source

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension’s source consists mainly of third‑party translation and PDF handling libraries. A large block of base64 data is flagged in pdf/web/wasm/openjpeg_nowasm_fallback.js:4 as an “obfuscation‑large_base64” pattern, but this file is part of the open‑source OpenJPEG WASM fallback and contains encoded image data, not hidden payloads. The only network‑related finding appears in pdf/web/wasm/jbig2_nowasm_fallback.js:2 and google/element_main.js:422, both simple fetch calls that load supporting scripts for PDF rendering – a normal behaviour for a translation tool that processes PDFs in‑page.

The IoC detector listed nine domain‑like strings such as this.center, popupdata.date, and radio.id (all reported from extracted_from_files). These strings are typical property names or placeholder values used by the bundled libraries and do not correspond to resolvable hosts. According to CVEQ’s known false‑positive patterns, the XIOC extractor frequently treats dotted object paths as domains, and none of the listed strings match known malicious infrastructure.

No malware‑signature or credential‑theft rules fired, and there are no manifest entries that replace the new‑tab page, inject scripts into banking sites, or request cookies from sensitive domains. The developer field contains an email address rather than a recognized organization, but the extension’s functionality (translation of webpage text and PDF content) aligns with its declared purpose. The modest user count (35 installs) does not itself indicate malicious intent.

A skeptic might argue that the presence of a large base64 blob and multiple “medium” severity findings suggests deliberate concealment of harmful code, especially given the unknown publisher. However, each flagged item maps directly to known open‑source components: the base64 block is image data for the fallback decoder, and the IoC strings are internal variable names. There are no outbound connections to the listed domains, no dynamic URL construction, and no code that accesses cookies or modifies browser settings. Therefore, the suspicious signals are explainable by normal library behaviour rather than hidden payloads.

In conclusion, the evidence points to benign bundled functionality generating a high volume of low‑value alerts. The extension does not exhibit any behavior that would compromise user privacy or security.

Key Reasons

• All detections are from bundled third‑party libraries (PDF/WASM fallbacks)
• IoC strings are internal property names, not real domains
• No malware signatures or credential‑theft patterns were found
• Network fetches load only supporting scripts for translation features

False Positive Considerations

• IoC extractor garbage
• Bundled dependencies generating many findings
• Obfuscation flag on legitimate base64 data
• Low‑severity generic alerts

Reviewed 2026-05-28; recommended action: suppress false positive; model confidence 82%.