Read Aloud A Text To Spee
✨ AI-Powered 🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Read Aloud uses text-to-speech (TTS) technology to convert webpage text to audio. It works on a variety of websites, including news sites, blogs, fan fiction, publications, textbooks, school and course materials. Read Aloud helps users who prefer to listen to content instead of reading, including children learning to read and those with dyslexia or other learning disabilities.
Read Aloud allows you to select from a variety of text-to-speech voices, including native voices provided by the browser and AI voices from cloud providers such as Google Wavenet, Amazon Polly, IBM Watson, Microsoft Azure, and OpenAI. Cloud-based voices may require additional in-app purchase or bringing your own API key to enable.
Read Aloud can read PDF, Google Docs, Google Play books, Amazon Kindle, and EPUB (via the excellent EPUBReader extension from epubread.com).
To use Read Aloud, navigate to the web page you want to read, then click the Read Aloud icon on the browser menu. You can also use the shortcut keys ALT-P, ALT-O, ALT-Comma, and ALT-Period to activate the extension. If some text is selected, Read Aloud will read only the selected text. Additionally, you can right click the text selection and start Read Aloud from the context menu.
To change the voice, reading speed, pitch, or enable text highlighting, go to the Options page via the Gear button on the extension popup (you'll need to stop playback to see the Gear button). You can also access the Options page from the context menu by right clicking the extension icon.
On the extension popup, there are buttons to increase/decrease the the size of the popup window, the font size, as well as toggle dark mode.
Read Aloud is an open-source project. If you wish to contribute bug fixes or translations, please visit the GitHub page at https://github.com/ken107/read-aloud
Tags
Privacy Practices
Security Analysis — Read Aloud A Text To Spee
Permissions
Code Patterns Detected
External Connections
Package Contents 93 files · 1MB
What This Extension Does
Read Aloud A Text To Spee is a Chrome extension that reads webpage articles aloud using text-to-speech technology. It supports over 40 languages and helps users with dyslexia or other learning disabilities. The extension can be used on various websites, including news sites, blogs, and textbooks.
Permissions Explained
- activeTabexpected: Allows the extension to access the current webpage.
Technical: Grants access to the active tab's content script injection, which can lead to data exposure if compromised. The extension uses this permission to read and process webpage content. - contextMenusexpected: Enables the extension to add context menu items for users to access its features.
Technical: Allows the extension to inject context menus, which can be used to execute malicious scripts if compromised. However, in this case, it's used for legitimate purposes like accessing options and settings. - identityexpected: Allows the extension to access user identity information.
Technical: Grants access to user identity data, which can be used for targeted attacks if compromised. However, in this case, it's likely used for authentication and authorization purposes within the extension. - offscreenexpected: Enables the extension to access web pages that are not currently visible on screen.
Technical: Allows the extension to access off-screen content, which can be used for malicious purposes like tracking or data scraping if compromised. However, in this case, it's likely used for legitimate purposes like reading webpage content. - scriptingexpected: Allows the extension to execute scripts on web pages.
Technical: Grants access to script injection, which can be used for malicious purposes like code execution or data exposure if compromised. However, in this case, it's likely used for legitimate purposes like text-to-speech processing. - storageexpected: Enables the extension to store and retrieve user data locally.
Technical: Allows the extension to access local storage, which can be used for malicious purposes like storing sensitive data or tracking user behavior if compromised. However, in this case, it's likely used for legitimate purposes like saving user preferences. - ttsexpected: Allows the extension to access text-to-speech functionality.
Technical: Grants access to TTS services, which can be used for malicious purposes like voice synthesis or data exposure if compromised. However, in this case, it's likely used for legitimate purposes like reading webpage content aloud. - ttsEngineexpected: Enables the extension to use a specific TTS engine.
Technical: Allows the extension to access a specific TTS engine, which can be used for malicious purposes like voice synthesis or data exposure if compromised. However, in this case, it's likely used for legitimate purposes like reading webpage content aloud. - webRequestcheck this: Allows the extension to intercept and modify web requests.
Technical: Grants access to web request interception, which can be used for malicious purposes like data exposure or tracking user behavior if compromised. This is a high-risk permission that requires careful evaluation. ⚠ 1 - webNavigationexpected: Enables the extension to access web navigation events.
Technical: Allows the extension to access web navigation events, which can be used for malicious purposes like tracking user behavior or data exposure if compromised. However, in this case, it's likely used for legitimate purposes like reading webpage content aloud. - https://translate.google.com/expected: Allows the extension to access Google Translate services.
Technical: Grants access to Google Translate services, which can be used for malicious purposes like data exposure or tracking user behavior if compromised. However, in this case, it's likely used for legitimate purposes like language translation.
Your Data
The extension accesses webpage content, including text and images, to read aloud using TTS technology. It also stores user preferences locally using local storage.
Technical Details
Code Findings
The extension uses function constructors, which can be used for malicious purposes like code injection or data exposure if compromised.
Technical: The extension uses the function constructor to dynamically execute code in its background service worker. This can lead to code injection attacks if an attacker compromises the extension's code.
💡 Function constructors are commonly used in legitimate extensions for dynamic code execution and caching.
The extension loads external scripts in its background service worker, which can be used for malicious purposes like code injection or data exposure if compromised.
Technical: The extension uses the importScripts method to load external scripts in its background service worker. This can lead to code injection attacks if an attacker compromises the extension's code.
💡 Loading external scripts is a common practice in legitimate extensions for caching and dynamic code execution.
The extension uses innerHTML assignments, which can be used for malicious purposes like cross-site scripting (XSS) attacks if compromised.
Technical: The extension uses innerHTML assignments in its content script to inject HTML elements. This can lead to XSS attacks if an attacker compromises the extension's code and injects malicious scripts.
💡 innerHTML assignments are commonly used in legitimate extensions for dynamic HTML injection and caching.
The extension uses String.fromCharCode, which can be used for malicious purposes like code obfuscation or data exposure if compromised.
Technical: The extension uses the String.fromCharCode method to encode strings. This can lead to code obfuscation attacks if an attacker compromises the extension's code and decodes malicious scripts.
💡 String.fromCharCode is commonly used in legitimate extensions for encoding and decoding data.
The extension makes XHR requests to various domains, which can be used for malicious purposes like data exposure or tracking user behavior if compromised.
Technical: The extension uses the XMLHttpRequest object to make requests to various domains. This can lead to data exposure attacks if an attacker compromises the extension's code and injects malicious scripts.
💡 XHR requests are commonly used in legitimate extensions for retrieving data from external sources.
The extension creates script elements dynamically, which can be used for malicious purposes like code injection or data exposure if compromised.
Technical: The extension uses the document.createElement method to create script elements dynamically. This can lead to code injection attacks if an attacker compromises the extension's code and injects malicious scripts.
💡 Creating script elements dynamically is commonly used in legitimate extensions for caching and dynamic code execution.
The extension has broad host permissions, which can be used for malicious purposes like data exposure or tracking user behavior if compromised.
Technical: The extension has broad host permissions that allow it to access various domains and services. This can lead to data exposure attacks if an attacker compromises the extension's code and injects malicious scripts.
💡 Broad host permissions are commonly used in legitimate extensions for accessing external services and data.
The Read Aloud A Text To Spee extension has some security concerns, including the use of function constructors, loading external scripts in its service worker, and creating script elements dynamically. However, these findings are not necessarily malicious and may be used for legitimate purposes. Users should exercise caution when installing extensions with broad host permissions or those that make XHR requests to various domains.
