Is Watch Together: Animes, Videos, Movies and + safe?
Watch Together renders other room members' usernames as raw HTML, letting any participant run script in the extension's privileged popup.
When you join a watch party, the extension displays each participant's self-reported name by inserting it directly into the popup's HTML without escaping it, so a room member can set their name to an HTML/script payload that executes the moment your popup opens. Because the popup runs with the extension's full permissions (including scripting and access to all sites), this can go beyond defacing the popup UI. Separately, all watch-party traffic -- usernames, room state, and the URL of the page being watched -- is sent over an unencrypted ws:// WebSocket connection to watchtogether.cloud rather than wss://, so it can be read or altered by anyone on the same network path.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 0.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/ and 1 more
Keep running in the background while your browser is open
background
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed Watch Together: Animes, Videos, Movies and + contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- watchtogether.cloud
Watch Together: Animes, Videos, Movies and + sends data to watchtogether.cloud. No other extension we have analyzed sends data here.