Is YouTube Comment Navigator 95 safe?

YouTube Comment Navigator injects a script that fetches attacker-chosen URLs with your YouTube cookies on unchecked postMessage requests.

On every YouTube page and embed, the extension injects a script into the page's main JavaScript context that listens for postMessage events without checking who sent them. Any page that can reach a YouTube tab or embedded iframe can send it a message telling it to fetch an arbitrary URL with attacker-chosen headers, and the request goes out carrying your YouTube session cookies and looking like it came from youtube.com. The response is then posted back to the sender.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.