Is FrankerFaceZ safe?

FrankerFaceZ exposes its settings store to YouTube pages via an unguarded externally_connectable message handler.

The extension registers a chrome.runtime.onConnectExternal handler that processes commands from any YouTube page, including reading all settings keys, writing or deleting individual keys, and clearing the entire settings store. This is possible because the manifest lists *://*.youtube.com/* in externally_connectable.matches, and the handler does not check whether the caller is an internal extension page or an external web page. No data is sent to external servers; the exposure is limited to YouTube-origin pages interacting with the extension's own IndexedDB-backed storage.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.