Is FrankerFaceZ safe?
FrankerFaceZ exposes its settings store to YouTube pages via an unguarded externally_connectable message handler.
The extension registers a chrome.runtime.onConnectExternal handler that processes commands from any YouTube page, including reading all settings keys, writing or deleting individual keys, and clearing the entire settings store. This is possible because the manifest lists *://*.youtube.com/* in externally_connectable.matches, and the handler does not check whether the caller is an internal extension page or an external web page. No data is sent to external servers; the exposure is limited to YouTube-origin pages interacting with the extension's own IndexedDB-backed storage.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itFrankerFaceZ - no other listings under this identity, 36 shared hostnames
FrankerFaceZ - no other listings under this identity, 36 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 36 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 4.80.4.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on twitch.tv
*://*.twitch.tv/*
Read and change your data on frankerfacez.com
*://*.frankerfacez.com/*
Store an unlimited amount of data in your browser
unlimitedStorage