Is Custom Progress Bar for YouTube™ safe?

Medium risk

Custom Progress Bar for YouTube is medium risk. On install, background.js generates and permanently stores a random ID. A 'notification' alarm fires every 5 min (12-hour delay), sending that ID and runtime ID to custom-progressbar.com/api/notification/. A planted marker confirmed this.

Clean Ironv4.0.3Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM

ClassUNWANTED

TypeUnexpected

CWECWE-359

SourceAI SANDBOX

A Permanent Install ID Is Sent to the Developer Every 5 Minutes

On install, background.js generates and permanently stores a random ID.

A 'notification' alarm fires every 5 min (12-hour delay), sending that ID and runtime ID to custom-progressbar.com/api/notification/.

A planted marker confirmed this.

01EvidenceCAUSE EFFECT

What actually happens

You did this

You install the extension. No further action is needed -- its background service worker keeps running.

The extension did this

Every 5 minutes, the extension sends a GET request to custom-progressbar.com carrying a random ID that was generated once at install and never changes.

We forced the extension's own recurring alarm to fire and observed the request leave with the ID attached.

02EvidenceTEMPORAL PATTERN

When this fires

Every 5 minutes

Starting 12 hours after install, the extension polls custom-progressbar.com/api/notification/ every 5 minutes for as long as the browser and extension keep running, attaching the same permanent ID each time.

03EvidenceCODE COMPARE

The code that does this

The ID is generated once at install, then read back and sent out on every alarm fire

What it actually does

Show shipped source

ID generated once, at install

chrome.storage.local.set({
  style: chrome.runtime.getURL("assets/css/style.css"),
  uid: Math.floor(Math.random() * Math.floor(Math.random() * Date.now())),
  extId: chrome.runtime.id,
  is_enable: true,
  current: getDefaultStyle(),
  styles: [],
  isChromeBottomVisible: false,
  c: 0,
  dateinstall: (new Date).getTime(),
  collections: STARTER_COLLECTIONS,
  version: "4.0.0",
});

The recurring alarm that reads the ID back and sends it out

chrome.alarms.create("notification", { delayInMinutes: 720, periodInMinutes: 5 });

chrome.alarms.onAlarm.addListener(async (alarm) => {
  if (alarm.name !== "notification") return;
  try {
    const { uid } = await storageGet(["uid"]);
    const url = new URL(notificationEndpoint()); // https://custom-progressbar.com/api/notification/?ext=<runtime id>
    if (uid) url.searchParams.set("uid", uid);
    const res = await fetch(url.toString());
    const data = await res.json();
    if (data && data.notifications) {
      await storageSet({ notifications: data.notifications });
    }
  } catch (e) {
    console.error("Error fetching notifications:", e);
  }
});

04EvidenceNETWORK CAPTURE

Captured request

GEThttps://custom-progressbar.com/api/notification/?ext=nbkomboflhdlliegkaiepilnfmophgfg&uid=<redacted>

The endpoint answered with an HTTP 404/308 in our test session -- a server-side response detail that doesn't affect the finding, which is that the request (with the permanent ID attached) leaves the device on schedule.

05EvidenceFIELD TABLE

What custom-progressbar.com receives on every 5-minute poll

	Field	Value	Why it matters
	Permanent install ID	uid=918273645 (illustrative -- a large random integer generated once at install)	A number generated once at install and never rotated; the same value is sent every 5 minutes for as long as the extension stays installed.
	Extension runtime ID	ext=nbkomboflhdlliegkaiepilnfmophgfg	Chrome's internal ID for this extension install, sent alongside the permanent ID.