Is Pixiv Toolkit safe?

Pixiv Toolkit overrides CORS headers on Pixiv and pximg domains, allowing any webpage to read image resources cross-origin.

The extension registers webRequest listeners on Pixiv-related domains and injects a forged Referer header to bypass hotlink protection on pximg.net. It also rewrites Access-Control-Allow-Origin response headers to '*', removing the original value. This means any webpage — not only pixiv.net or fanbox.cc — can issue cross-origin requests to i.pximg.net and read the response content in JavaScript.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.