Is LBOOM safe?

High risk

LBOOM is high risk. With this extension installed, requests to Facebook, Instagram, X, or Twitter get their Origin header silently replaced and Sec-Fetch-* overridden, so the service worker can issue authenticated API calls appearing to come from the platform.

LBOOMv2.4Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Origin and security headers rewritten on social platform requests

With this extension installed, requests to Facebook, Instagram, X, or Twitter get their Origin header silently replaced and Sec-Fetch-* overridden, so the service worker can issue authenticated API calls appearing to come from the platform.

Severity
High unwanted
Type
Unexpected
CWE
CWE-940
Source
Dynamic sandbox
What actually happens
You did this

You visit or use Facebook, Instagram, X, or Twitter in the browser.

Any tab open to these platforms generates XHR requests that the extension intercepts automatically.

The extension did this

The extension replaces the Origin header and Sec-Fetch-* security headers on every matching request.

This removes the browser's CORS and same-origin checks, allowing the extension to make authenticated API calls that look like first-party platform requests.

The code that does this

Rule 2, Instagram GraphQL endpoint header rewrite

Readable version
{  "id": 2,  "priority": 2,  "action": {    "type": "modifyHeaders",    "requestHeaders": [      { "header": "origin",          "operation": "set", "value": "https://www.instagram.com" },      { "header": "sec-fetch-site",  "operation": "set", "value": "same-origin" },      { "header": "sec-fetch-mode",  "operation": "set", "value": "cors" },      { "header": "sec-fetch-dest",  "operation": "set", "value": "empty" }    ]  },  "condition": {    "urlFilter": "||instagram.com/graphql/query",    "resourceTypes": ["xmlhttprequest"]  }}
The code that does this

Rule 6, X.com catch-all with X-Frame-Options removal and Origin spoof

Readable version
{  "id": 6,  "priority": 1,  "action": {    "type": "modifyHeaders",    "responseHeaders": [      { "header": "x-frame-options", "operation": "remove" }    ],    "requestHeaders": [      { "header": "origin",          "operation": "set", "value": "https://x.com" },      { "header": "sec-fetch-site",  "operation": "set", "value": "none" },      { "header": "sec-fetch-mode",  "operation": "set", "value": "navigate" },      { "header": "sec-fetch-dest",  "operation": "set", "value": "document" }    ]  },  "condition": {    "urlFilter": "||x.com/",    "resourceTypes": ["xmlhttprequest", "sub_frame"]  }}
Headers overwritten on every matching request
  • Origin
    https://www.instagram.com

    Replaced with the target platform's own origin, making the request appear to come from the platform itself rather than the extension.

  • Sec-Fetch-Site
    same-origin

    Set to same-origin or none, telling the browser this is a first-party request and suppressing CORS restrictions.

  • Sec-Fetch-Mode
    cors

    Set to cors or navigate, bypassing cross-origin fetch guards.

  • Sec-Fetch-Dest
    empty

    Set to empty or document, completing the disguise of the request as a platform-native call.

What it can do

Permissions this extension asks for, as declared in version 2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 2.4, which we have not unpacked yet.

  • Read and change your data on likeboom.net

    *://*.likeboom.net/*

  • Read and change your data on facebook.com

    *://*.facebook.com/*

  • Read and change your data on instagram.com

    *://*.instagram.com/*

  • Read and change your data on fbcdn.net

    *://*.fbcdn.net/*

  • Read and change your data on x.com

    *://*.x.com/*

  • Read and change your data on twitter.com

    *://*.twitter.com/*

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Run hidden pages in the background

    offscreen

  • Schedule its own background tasks

    alarms

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026jbcbollcobedacdikijdmkeogbcfeggd