Is Kylian Mbappé MeaVana safe?

Kylian Mbappé MeaVana strips anti-framing headers from sites it embeds in its own new-tab iframes.

The extension's background worker installs declarativeNetRequest rules that remove the X-Frame-Options, Frame-Options, and Content-Security-Policy response headers on pages loaded inside its own iframe UI (such as embedded integration/panel views), regardless of which external site is being shown. It also runs a New Tab dashboard with utility widgets: an IP lookup tool that sends the user's public IP to ip-api.com over plain HTTP, and a translation tool that calls Google's Cloud Translation API using a hardcoded key shipped in the extension's code. A PostHog analytics SDK is bundled and initialized on the extension's own pages (New Tab, Options, Side Panel) with default autocapture settings.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.