Is A bored button safe?
A bored button inserts titles from a remote Firestore site list into visited pages with innerHTML.
When the user presses the extension button, the background script fetches a site list from Firestore, opens the chosen URL, and sends that remote site's title to a content script. The content script runs on all pages and renders the title inside an injected rating panel using innerHTML, so HTML in the remote title is inserted into the page DOM.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed A bored button contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- firestore.googleapis.com
A bored button sends data to firestore.googleapis.com. 16 other extensions we have analysed send data here.