Executive brief
The DeepL Chrome extension, a popular tool for translating web content, contains a security flaw that allows malicious code to run in a user's browser. If a user interacts with a specially crafted website or content, an attacker could inject malicious scripts to steal information or manipulate the appearance of web pages. This issue affects users who have the extension installed and active while browsing.
Technical details
A cross-site scripting (XSS) vulnerability exists in the DeepL Chrome extension due to improper neutralization of user-controlled input, such as search queries or page content, before rendering it into the Document Object Model (DOM). The vulnerability was introduced in version 1.22.0; subsequent attempts to fix it in versions 1.22.2 and 1.23.0 were incomplete. An attacker can exploit this by enticing a user to visit a malicious site or interact with specific content, leading to the execution of arbitrary JavaScript in the context of the user's browser session. This can result in the theft of session tokens or unauthorized modification of web page content. A complete fix has been released in version 1.24.0.
Affected products
- DeepL DeepL Chrome extension v1.22.0 to v1.23.0
Timeline
- 2026-01-23: advisory: Initial GitHub security advisory published by developer
- 2026-04-22: disclosed: Public disclosure via JVN and NVD
- 2026-04-22: patched: Final patch confirmed in version 1.24.0