Is Custom Themes for YouTube™ safe?
We analyzed Custom Themes for YouTube™ version 2.0.3's actual code and gave it a 78/100 trust score. This is a mostly purpose-aligned YouTube theme…
Bottom line
This is a mostly purpose-aligned YouTube theme extension, but its optional custom-code feature creates a meaningful security concern.
What it can access
It can change YouTube pages and store theme settings, matching its purpose. [Q1] It also adds video controls such as picture-in-picture. [Q2][Q5]
Security weaknesses
An optional feature executes JavaScript pasted by the user, so unsafe code could harm the YouTube page or account. [Q11] No remote code path was found. [Q7]
Signs of misuse
No evidence shows tracking, sensitive-data collection, or remote control. [Q6][Q12] Installation opens an unrelated website once, which is a minor concern. [Q8]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests activeTab, storage, scripting, and persistent YouTube host access. Those permissions match theme injection and optional page tools.
Declares activeTab, storage, scripting, a YouTube host permission, and a YouTube content script. — manifest.json:21-41
Which websites can it run on, and can it read or change what appears on those pages?
It changes YouTube page styling and can inspect the video player, first video, live-chat iframe, masthead, and theme-related elements.
Finds videos and the movie player and installs a theme style element. — assets/content/pip.js:1
Changes YouTube DOM styles and live-chat appearance. — assets/themes/classic.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Touches only video/player elements and a style node. — assets/content/pip.js:1
Performs visual DOM changes without extracting content. — assets/themes/classic.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores the chosen theme, custom CSS, scrollbar and picture-in-picture settings, enable state, and optional user-pasted JavaScript.
Reads theme and option keys from chrome.storage.local. — assets/background/background.js:1
Saves theme, CSS, picture-in-picture, and JS-plugin values through extension storage. — popup.js:40
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can request picture-in-picture for the first YouTube video and change video scaling. It has no download, clipboard, camera, microphone, or capture permission.
Calls requestPictureInPicture after F9 or a visible icon click and handles Alt-plus/minus scaling. — assets/content/pip.js:1
Declares no download, clipboard, camera, microphone, or capture permission. — manifest.json:21-41
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Fetches only packaged extension resources; the only external actions are fixed addonup.com install and mymoneyrain.com uninstall URLs. — assets/background/background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads CSS and JavaScript only through chrome.runtime.getURL from packaged assets. — assets/background/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The selected theme is reapplied automatically when YouTube loads. Installation also opens addonup.com once, which is unrelated to applying the theme but carries no user data.
Requests apply_theme_if_enabled one second after the content script starts. — assets/content/pip.js:1
Handles the request and opens addonup.com on first install. — assets/background/background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings or network-control permission. — manifest.json:21-41
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The popup is a minified React bundle, while the background and theme code remain readable. No packing, encrypted strings, or anti-analysis behavior was found.
Contains a normal minified React/Tailwind bundle with readable feature labels and storage keys. — popup.js:1-40
Uses readable names and direct control flow. — assets/background/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
It executes user-pasted JavaScript with eval on YouTube. The source is the local JS-plugin text field, the feature is disabled by default and marked 'trusted only,' and no remote source-to-sink path was found.
Provides a JS plugins toggle, 'trusted only' warning, textarea, Save and Install button, and Remove All action. — popup.js:40
Reads youtube_darkmode_pro_jswidget_code from local storage and passes it as code to an injected function that calls eval(code). — assets/background/background.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Contains local YouTube URL helpers and no URL upload or history API. — assets/background/background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no analytics or external data request. — assets/background/background.js:1
Contains local settings UI and fixed outbound links only. — popup.js:40
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies permission. — manifest.json:21-41
Does not inspect account or authentication state. — assets/content/pip.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Key handlers only test F9 and Alt-plus/minus and do not store or transmit keys. — assets/content/pip.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
All settings and executable inputs come from packaged files or local user choices. — assets/background/background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds a style element and optional picture-in-picture icon and video transform. — assets/content/pip.js:1
Changes theme styles and YouTube masthead/page attributes. — assets/themes/classic.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
fetchResource builds chrome-extension URLs with chrome.runtime.getURL. — assets/background/background.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or file-system capability. — manifest.json:21-41
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads packaged theme files and locally stored custom CSS/JavaScript without a remote fetch path. — assets/background/background.js:1
The user directly enters and enables any custom JavaScript. — popup.js:40
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable section or MAIN-world content script. — manifest.json:21-41
Uses chrome.runtime messaging without exposing a window-message or CustomEvent listener. — assets/content/pip.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Provides visible controls for each stored option and labels the JS plugin feature as trusted-only. — popup.js:40
Checks youtube_js_enable before executing saved JavaScript. — assets/background/background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Handles theme loading, injection, and settings only. — assets/background/background.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Packaged content logic changes styles, video scaling, and picture-in-picture only. — assets/content/pip.js:1
The custom-JS capability executes arbitrary user input but supplies no built-in form-editing code. — assets/background/background.js:1