Am I Being Pwned?
Get started

Is 7TV safe?

Medium risk

7TV fetches a remote configuration from its servers to determine which other installed extensions to flag for disabling.

On startup, 7TV requests https://7tv.io/v3/config/extension and parses a compatibility list of extension IDs from the response. Any installed extension whose ID appears in that server-controlled list is displayed with a warning in the 7TV Compat UI, and a Disable button is presented to the user. With the optional management permission granted, clicking that button calls chrome.management.setEnabled to disable the targeted extension — with the target set entirely determined by the remote server.

7TVv3.1.27Firefox Add-ons
45Risk
Who publishes it

7TV - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
7TV
Website
7tv.app

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

extension.7tv.gg
Also called by 4 other listings, including 7TV Nightly, 7TV Nightly, 7TV

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote compatibility config can flag extensions for disabling

MediumunwantedCWE-829Dynamic sandbox

The compatibility screen requests 7TV's config from 7tv.io.

What actually happens

You did this

You open 7TV's compatibility screen during onboarding or from settings.

The screen includes a Check Compatibility flow that asks for the optional management permission.

The extension did this

The extension downloads a server-provided compatibility list and compares it with installed extensions.

If an installed extension is listed with issues, the UI shows the issue text and can offer a DISABLE button after permission is granted.

Captured request

GEThttps://7tv.io/v3/config/extension

Observed during dynamic analysis when the compatibility UI loaded; the code parses the response as JSON and stores it as the compatibility configuration.

Fields that drive the compatibility decision

  • Matched extension IDs
    ["ajopnjidmegmdimjlfnijceegpefgped", "firefox@betterttv.net"]

    Lets the compatibility list decide which installed extensions appear as concerns in the UI.

  • Issue severity
    DUPLICATE_FUNCTIONALITY

    Sets the warning category and color shown beside a matched extension.

  • Issue message
    A significant amount of functionality from this extension is also in 7TV. While there is no known immediate clashing with this extension, such redundancy may decrease performance

    Controls the explanatory text shown to you for the matched extension.

  • Installed extension state
    BetterTTV 7.6 enabled

    Lets the UI decide whether the matched extension is still enabled and should receive a DISABLE button.

The code that does this

Compatibility config drives the warning list and disable action

Readable version

Readable Compat setup logic

deobfuscated/assets/seventv.Compat.3.1.22.js
fetch("https://7tv.io/v3/config/extension").then(e => e.json()).then(e => h.value = e);function O() {  chrome.permissions.request({    permissions: ["management"]  }, e => {    d.value = e  })}function T() {  chrome.management.getAll(e => {    var s, c;    _.value.length = 0, f.clear(), _.value = e.filter(t => t.type === "extension");    const i = [];    for (const t of _.value) {      const l = (c = (s = h.value) == null ? void 0 : s.compatibility) == null ? void 0 : c.find(r => r.id.includes(t.id));      i.push([t, l ?? {        id: [],        issues: []      }])    }    i.sort(([, t], [, l]) => t.issues.length > l.issues.length ? -1 : 1);    for (const [t, l] of i) f.set(t, l)  })}function x(e) {  chrome.management.setEnabled(e.id, !1, () => {    e.enabled = !1  })}

Readable render logic for warnings and the button

deobfuscated/assets/seventv.Compat.3.1.22.js
b(D, null, {  default: g(() => [c.issues.length ? (n(), o("div", J, [(n(!0), o(N, null, C(c.issues, (r, L) => (n(), o("div", {    key: L,    class: "ext-compat-concern"  }, [a("h4", {    style: E({      color: k[r.severity]    })  }, m(r.severity.replace("_", " ")), 5), a("p", null, m(r.message), 1)]))), 128))])) : p("", !0)]),  _: 2}, 1024), c.issues.length && s.enabled ? (n(), o("div", Z, [a("button", {  onClick: r => x(s)}, "DISABLE", 8, ee)])) : p("", !0)

Remote host involved in the compatibility decision

    • 7tv.io

    Receives the compatibility configuration GET request and returns the extension ID and issue list that the UI uses for matching.

What it can do

Permissions this extension asks for, as declared in version 3.1.27. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on twitch.tv

    *://*.twitch.tv/*

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed 7TV contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 7tv.io

    7TV sends data to 7tv.io. 4 other extensions we have analyzed send data here.

Updated 2 November 2026amo-2794274