Is M3U8 Keeper safe?

M3U8 Keeper injects the current tab's title unsanitized into its popup, letting visited pages run script inside the extension.

The extension watches every page for network requests containing '.m3u8' and stores the tab's title alongside each captured link. When the popup or new-tab page later displays that history, it inserts the stored title directly into the page's HTML instead of as plain text, so a web page that sets its own document title to contain HTML/script tags can run code with the extension's privileges. Separately, a script the extension injects into every site intercepts all XHR and fetch requests and broadcasts the full response body of each one to the page via postMessage with no origin restriction, so any other script running in that page can read it.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.