[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

YouTube Watched Marker

Version 1.5.0 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Developer: giraybal.com

Rating: 4.3 ★ (36 ratings)

Users: 2,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a reasonable user base of 2,000 users with a solid 4.3-star rating from 36 reviews, indicating generally positive user experiences. The developer domain (giraybal.com) appears to be a personal developer site. The extension's purpose of marking watched YouTube videos is legitimate and useful for users who want to track their viewing history.

Concerns: The primary concern is the broad host permissions for all YouTube domains (*://*.youtube.com/*), which technically allows the extension to access all YouTube pages and potentially collect extensive browsing data beyond what's necessary for its stated functionality. While the storage permission is appropriate for saving watched video markers, the combination with broad YouTube access creates potential for data collection. The relatively small user base and personal developer domain provide less assurance about long-term support and security practices compared to established companies.

Recommendations: This extension presents moderate risk due to its broad YouTube permissions. Consider running it in a separate Chrome profile if you're concerned about privacy. Monitor the extension's behavior and review permissions periodically. Since it only affects YouTube, the risk is contained to that platform. Users comfortable with YouTube-specific extensions and who find the functionality valuable may find the risk acceptable, but privacy-conscious users should evaluate whether the convenience justifies the broad access permissions.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage

Host Permissions:

*://*.youtube.com/*

Embedded URLs (55 total):

https://clients2.google.com/service/update2/crx	https://jquery.com/
https://jquery.org/license	https://github.com/whatwg/html/issues/2369
https://html.spec.whatwg.org/#nonce-attributes	https://drafts.csswg.org/cssom/#common-serializing-idioms
https://www.w3.org/TR/css-syntax-3/#ident-token-diagram	https://www.w3.org/TR/selectors/#attribute-selectors
https://www.w3.org/TR/CSS21/syndata.html#escaped-characters	https://bugs.jquery.com/ticket/13393
https://github.com/jquery/sizzle/issues/157	https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled	https://html.spec.whatwg.org/multipage/forms.html#category-listed
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
https://bugs.webkit.org/show_bug.cgi?id=136851	https://drafts.csswg.org/selectors/#relational
https://github.com/jquery/sizzle/pull/225	https://www.w3.org/TR/selectors/#pseudo-classes
https://github.com/jquery/sizzle/issues/299	https://www.w3.org/TR/selectors/#lang-pseudo
https://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked	https://www.w3.org/TR/selectors/#empty-pseudo
https://promisesaplus.com/#point-59	https://promisesaplus.com/#point-48
https://promisesaplus.com/#point-54	https://promisesaplus.com/#point-75
https://promisesaplus.com/#point-64	https://promisesaplus.com/#point-61
https://promisesaplus.com/#point-57	https://bugs.chromium.org/p/chromium/issues/detail?id=378607
https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click	https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order
https://bugs.chromium.org/p/chromium/issues/detail?id=449857	https://bugs.chromium.org/p/chromium/issues/detail?id=470258
https://connect.microsoft.com/IE/feedback/details/1736512/	https://jsperf.com/getall-vs-sizzle/2
https://www.w3.org/TR/css-syntax-3/#input-preprocessing	https://drafts.csswg.org/cssom/#resolved-values
https://developer.mozilla.org/en-US/docs/CSS/display	https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace	https://html.spec.whatwg.org/#strip-and-collapse-whitespace
http://example.com:80x/	https://bugs.webkit.org/show_bug.cgi?id=137337
https://bugs.webkit.org/show_bug.cgi?id=29084	https://bugs.chromium.org/p/chromium/issues/detail?id=589347
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	https://github.com/jquery/jquery/pull/557
https://www.giraybal.com	https://www.youtube.com/
https://chromewebstore.google.com/detail/youtube-watched-marker/ijjckihakhfegpkpjpmmflfmcfmcdhlk

Raw Manifest

{
  "name": "YouTube Watched Marker",
  "icons": {
    "16": "yt/logos/16.png",
    "48": "yt/logos/48.png",
    "128": "yt/logos/128.png"
  },
  "action": {
    "default_popup": "yt/popup.html",
    "default_title": "YouTube Watched Marker"
  },
  "author": "Giray Bal",
  "version": "1.5.0",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Easily mark the YouTube videos you watched as watched.",
  "permissions": [
    "storage"
  ],
  "content_scripts": [
    {
      "js": [
        "static/js/jquery-3.7.1.min.js",
        "same.js",
        "yt/content.js"
      ],
      "css": [
        "static/css/my.css"
      ],
      "matches": [
        "*://*.youtube.com/*"
      ]
    }
  ],
  "host_permissions": [
    "*://*.youtube.com/*"
  ],
  "manifest_version": 3
}

by ✦ Astarte