Is Synclify - Watch in sync with your friends safe?
Synclify sends video-detection failures with the full page URL and a persistent analytics ID to its API.
When Synclify cannot find a video on a page, it records a PostHog event that includes the full page URL and links it to a persistent ID stored by the extension. The extension can also inject a persistent main-world debug shield into the active site that hides or rewrites DevTools-related cookies and changes page APIs such as eval, Function, timers, history, and window.open.
Who publishes itSynclify - no other listings under this identity
Synclify - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Debug-shield path injects page-tampering hooks into the active origin
On the relevant user action, Synclify injects a persistent MAIN-world script into the active tab's origin, overriding page APIs for DOM behavior and cookies: webdriver, cookie, timers, eval, navigation, history, window.open, parts of fetch.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
A user-driven extension action enables the debug-shield path.
The extension registers a persistent MAIN-world content script that changes page APIs in the active origin.
- Page DOM content<div id="app">...</div> (illustrative)
Page-level hooks can change how the active origin's document and related browser APIs behave.
- Site cookiesdocument.cookie = "session_id=..." (illustrative)
Cookie reads and writes can affect session state and site context for the active origin.
Dynamic analysis confirmed that the background script registers debugShield.js in the MAIN world with all-frames persistence, and that the script overrides webdriver, cookie, eval, history, and fetch-related behavior.
What it can do
Permissions this extension asks for, as declared in version 0.5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on api.synclify.party
https://api.synclify.party/*
Read and change your data on localhost:3001
http://localhost:3001/*
Read and change your data on eu.i.posthog.com
https://eu.i.posthog.com/*
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed Synclify - Watch in sync with your friends contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.synclify.party
Synclify - Watch in sync with your friends sends data to api.synclify.party. No other extension we have analysed sends data here.