There are dozens of chrome extensions that translate (read: submit to untrusted server) on hover / highlight / context menu / textarea edit / etc. It is implied, that user acknowledges this functionality and accepts the risk. This includes untrusted server (because that's how they proxy requests to Google/Bing/Yandex Translate without exposing API keys).

Security illiteracy? Yes. Malicious intent? Probably no.

Does being security illiterate equal malicious? Debatable.

A moderately popular Chrome extension is frequently bought for tens of thousands of dollars for various purposes, frequently malware injection. They contact extension makers.

I think the bar for trust in terms of evil intent is on the floor.

No reasonable person expects privacy when using Google and/or Google provided products / software.

When you use Debian, you have a reasonable expectation of privacy.

People who handwave that away or say it's not as bad as something else either have an agenda or are ignorant about the history of Debian.

Not sure if I would call it malicious but I would call it gross negligence.

[flagged]