Extension Details
Context-Aware Verdict
The extension has very limited adoption with only 103 users and just 4 reviews, making it difficult to assess reliability through community feedback. The perfect 5.0 rating is based on an extremely small sample size. The lack of developer information raises transparency concerns, as users cannot verify the creator's identity or track record. The extension's narrow focus on YouTube windowed fullscreen functionality suggests a legitimate use case, but the limited user base means it hasn't been thoroughly vetted by the community.
The tabs permission is excessive for a YouTube fullscreen utility, as this functionality typically only requires content script access to modify page behavior. This permission allows the extension to monitor and manipulate all browser tabs, creating privacy and security risks. The broad host permissions are appropriately scoped to YouTube domains, which is reasonable for the stated functionality. The combination of tabs access with YouTube permissions could potentially enable tracking of video viewing habits across all browser tabs.
Consider running this extension in a separate Chrome profile to isolate potential risks from your main browsing session. Look for alternative extensions with similar functionality but more restrictive permissions and larger user bases. If you must use this extension, regularly review your browser tabs and be cautious about sensitive activities while it's active. Monitor for any unusual browser behavior or performance issues that might indicate malicious activity.
Findings
Security Analysis Details
Required Permissions:
- tabs
- storage
Host Permissions:
- *://*.youtube.com/*
Embedded URLs (7 total):
| https://www.google.com/favicon.ico | https://accounts.google.com/o/oauth2/v2/auth?scope=https%3A//www.googleapis.com/auth/userinfo.profile+https%3A//www.googleapis.com/auth/userinfo.email&access_type=offline&include_granted_scopes=true&response_type=code&client_id= | |
| https://pay.extensiondata.com | http://www.w3.org/2000/svg | |
| https://fonts.googleapis.com | https://fonts.gstatic.com | |
| https://fonts.googleapis.com/css2?family=Roboto:wght@400 |
Raw Manifest
{ "name": "__MSG_app_name__", "icons": { "16": "icons/icon16.png", "48": "icons/icon48.png", "128": "icons/icon128.png" }, "action": { "default_icon": { "16": "icons/icon16.png", "48": "icons/icon48.png" }, "default_popup": "popup.html" }, "author": "xiran_ytbwindow__001", "version": "5.2", "background": { "service_worker": "background.js" }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "__MSG_app_description__", "permissions": [ "tabs", "storage" ], "default_locale": "en", "content_scripts": [ { "js": [ "content_script.js" ], "css": [ "content_style.css" ], "matches": [ "*://*.youtube.com/*" ] } ], "host_permissions": [ "*://*.youtube.com/*" ], "manifest_version": 3 }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.