Is BetterFloat safe?
We analyzed BetterFloat version 3.6.10's actual code and gave it a 78/100 trust score. BetterFloat has broad but purpose-aligned marketplace access, with…
Bottom line
BetterFloat has broad but purpose-aligned marketplace access, with no established evidence of harmful misuse.
What it can access
The extension can automatically inspect and change pages across many named CS2 marketplaces, matching its advertised purpose but covering a wide range of sites. [Q2] It may process marketplace content and responses, while sensitive form capture and browser-session theft were not established. [Q3] [Q
Signs of misuse
The extension contacts its own service and marketplace-related services for subscriptions and feature data, but no unexplained collection or general browsing tracking was established. [Q6] [Q12] Remote responses were found to be processed as data, not executable instructions, and credential theft or
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension can read and modify pages across many named CS2 marketplaces, which broadly fits its stated purpose but gives it substantial site-specific access.
The manifest requests scripting, activeTab, storage, unlimitedStorage, notifications, and omnibox permissions, and lists many CS2 marketplace, Steam, and related domains for access. — manifest.json:1
Content scripts are configured to run automatically on numerous named marketplace websites, allowing the extension to process and change those pages. — manifest.json:1
Optional access includes all HTTP and HTTPS websites and buff.market, but that access requires later approval. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.csfloat.com/*, *://*.skinport.com/*, *://*.skinbid.com/*, *://*.avan.market/*, *://*.bitskins.com/*, *://*.cs.money/*, *://*.dmarket.com/*, *://*.steamcommunity.com/* — manifest.json:1
Content scripts run directly on: *://*.avan.market/*, *://*.bitskins.com/*, https://*.buff.market/*, https://*.csfloat.com/*, https://*.cs.money/*, *://*.dmarket.com/*, *://*.gamerpay.gg/*, *://*.haloskins.com/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
On supported marketplace pages, content scripts and page-world hooks can read page DOM and API responses, so information displayed there may be visible to the extension. I found no established path that reads typed passwords, payment fields, messages, or form values and sends them elsewhere, but the large bundled scripts prevent a fully conclusive exclusion.
Content scripts run on listed marketplace origins; scripting and host permissions enable supported-page integration. — manifest.json:1
The packaged page-world script hooks page fetch and XMLHttpRequest responses for supported sites. — betterfloat-main.js:1-2
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
I found no demonstrated access to browser cookies, browsing history, bookmarks, or downloads. Requests made by page scripts can use the current site’s normal signed-in session, but that is not evidence that the extension extracts the session.
Does not declare cookies, history, bookmarks, or downloads permissions. — manifest.json:2-3
Search results show browser-API metadata from a bundled polyfill, not calls using those APIs. — background.js:1-3
Uses credentials: include for a same-site inventory request, which is ordinary first-party session use rather than cookie extraction. — content-scripts/skinflow.js:100
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends requests to BetterFloat’s service and several market/API services to retrieve subscriptions, prices, inventories, exchange rates, patterns, and tier-list data. The code inspected does not show a general telemetry upload of all browsing activity, but page/network data is processed locally and some requests use site credentials normally.
Fetches BetterFloat subscription data and CDN blue-gem pattern data. — background.js:1,3
Calls api.betterfloat.com/subscription/{id} to refresh subscription information. — content-scripts/skinport.js:4
Requests CSFloat exchange rates/inventory and retrieves tier-list data from GitHub. — content-scripts/csfloat.js:7,116,249
Requests currency data from api.gamerpay.gg and caches it in page localStorage. — content-scripts/gamerpay.js:126
Does it download or run code, settings, or instructions supplied by a remote server?
The extension downloads remote JSON and API data, including configuration-like marketplace data, but the inspected runtime contains no established path that treats a server response as JavaScript or executes it as instructions. Remote data appears to be consumed as data by packaged code.
The service worker contains remote fetch and response-processing logic, but no established eval, Function constructor, script download-and-run, or equivalent execution path was identified. — background.js:1-3
The content script fetches remote marketplace data and uses packaged logic to process it; a remote-code execution path was not established. — content-scripts/csfloat.js:1-249
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension automatically injects supported-site scripts and performs page processing when matching pages load, without a separate click for each operation. Some stronger actions, such as omnibox navigation or notification handling, are tied to user input.
Many marketplace content scripts are configured to run automatically at document_end or document_idle. — manifest.json:1
The Bitskins content script performs automatic page interaction after detecting the relevant page state. — content-scripts/bitskins.js:1-100
The service worker contains tab, omnibox, notification, and message event handlers. — background.js:1-3
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the extension ships very large bundled and minified JavaScript files, including multi-megabyte content scripts and a large service worker. This reduces auditability, although minification alone is not evidence of malicious behavior.
The service worker is a large bundled file represented in only a few lines. — background.js:1-3
The CSFloat content script is a multi-megabyte bundled/minified file. — content-scripts/csfloat.js:1-249
The popup bundle is also very large and bundled. — chunks/popup-CdOjce3N.js:1-10
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
I found no direct eval(), new Function(), or string-based timer execution in the extension’s readable source search. Ordinary callback-based timers are present; minified/generated code means this is not an absolute guarantee.
Search found no direct eval( or new Function usage in readable extension files. — background.js:1-3
Uses callback-based setTimeout for retries and delayed work, not string arguments. — background.js:1-3
Uses callback-based setTimeout while intercepting page requests. — betterfloat-main.js:1-2
Does it track the websites, pages, searches, or links you visit?
The extension observes URLs and responses while operating on supported marketplace pages, but I found no established storage, cross-site correlation, analytics transmission, or browsing-history sink that would constitute tracking. This is limited site-specific observation rather than demonstrated tracking of general browsing.
Page-world fetch and XMLHttpRequest hooks observe supported-page requests and responses. — betterfloat-main.js:1-2
Automatic content scripts are limited to listed marketplace origins rather than all webpages. — manifest.json:1
Does it create a persistent ID or browser fingerprint to recognize you?
No persistent browser ID or fingerprinting was found in the inspected code. The extension does store settings and market data, but that is not itself user tracking.
Storage is used for cached blue-gem data and settings; no browser-fingerprint or tracking-ID use was identified. — background.js:1-3
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension makes requests to marketplace APIs, including a same-site request with credentials, but no complete path copies cookies, tokens, or page contents to an unrelated destination. Sending credentials back to the site’s own API is ordinary authenticated site behavior, not proof of theft.
A request to https://api.skinflow.gg/me/inv uses credentials: include; the destination is the service’s own API. — content-scripts/skinflow.js:100
The content script contains marketplace data requests, with no established unrelated exfiltration sink in the cited runtime. — content-scripts/csfloat.js:1-7
The service worker fetches BetterFloat-related remote data, not an established copy of browser cookies or page contents. — background.js:1-3
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records typing, form values, clipboard contents, or screenshots. Clipboard writes are used to copy generated item text, which is different from reading the clipboard.
Writes an item name to the clipboard after the user clicks a copy control. — content-scripts/csfloat.js:169-169
Writes a generated command to the clipboard after a user click; no clipboard read is shown. — content-scripts/csfloat.js:198-198
Can a website or remote server send commands that make the extension take actions?
The manifest advertises external messaging for rums.dev pages, but the service worker’s origin check accepts only https://betterfloat.com/. Because those origins do not match, the declared external-message route cannot pass its own validation for ordinary rums.dev pages.
externally_connectable lists https://*.rums.dev/*. — manifest.json:1
The onMessageExternal handler rejects messages unless sender.origin is exactly https://betterfloat.com/; only after that check does it write newSettings to sync storage. — background.js:3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The extension visibly augments marketplace pages and creates links to external item-analysis sites. The inspected evidence does not prove referral-code, advertisement, search-result, or cart manipulation across all site-specific scripts.
Adds a link to bluegemlab.com for item analysis. — content-scripts/csfloat.js:307-307
Builds and inserts marketplace tooltip content based on item data. — content-scripts/csfloat.js:80-80
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension hooks page-level fetch and XMLHttpRequest on supported pages, but that observes or processes page requests rather than redirecting them or changing browser-wide traffic. It lacks webRequest, proxy, downloads, and related permissions, and no header-modification or download sink was established.
The packaged page-world script replaces or wraps page fetch and XMLHttpRequest methods to observe responses. — betterfloat-main.js:1-2
Declared permissions do not include webRequest, webRequestBlocking, proxy, or downloads. — manifest.json:1
Can it communicate with software on the computer or services running on localhost?
No extension code was found that connects to localhost or native computer software. The localhost reference appears inside a bundled library's environment check rather than an extension connection.
The localhost/127.0.0.1 text occurs in a library check for the current page location. — content-scripts/csfloat.js:7-7
No nativeMessaging permission is declared. — manifest.json:1-1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension injects packaged JavaScript into supported pages, but the identified scripts are ordinary web-accessible extension resources rather than data that is decoded and then executed. No complete decrypt-or-unpack-to-execution chain was established.
The content script loads the packaged betterfloat-main.js resource into the page main world. — content-scripts/csfloat.js:1-5
betterfloat-main.js and skinport-main.js are declared web-accessible resources for selected marketplace origins. — manifest.json:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Web-accessible files are limited resources that marketplace pages can request; they do not grant those pages privileged extension APIs. The only apparent external privileged-message route is blocked by the mismatch between the manifest’s rums.dev allowlist and the service worker’s betterfloat.com origin check.
Only betterfloat-main.js, skinport-main.js, and marketids.json are exposed to listed marketplace origins; externally_connectable lists rums.dev. — manifest.json:1
The external-message handler rejects any sender whose origin is not exactly https://betterfloat.com/ before writing sync settings. — background.js:3
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior is conditional on supported websites, page state, user interactions, stored settings, and subscription or account state. This appears feature-driven rather than evidence of covert targeting, but it is conditional behavior.
Content scripts are restricted to numerous named marketplace domains. — manifest.json:1-1
Inventory fetching is conditional on page/account state and runs only when the relevant site data is available. — content-scripts/skinflow.js:100-100
Cached data and settings affect whether remote pattern data is fetched. — background.js:1-3
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining or comparable hidden resource-intensive workload was found. The visible background work concerns market data, cached mappings, and messaging.
Background operations shown are data fetches, caching, and message handling. — background.js:1-3
Does it change form fields or where a form sends its information?
The extension modifies marketplace page elements and creates controls, but the inspected evidence does not prove systematic form-field or form-destination changes. Full site-script review is limited by minification and generated code.
Adds a clickable generated-code control to the page. — content-scripts/csfloat.js:198-198
Replaces or augments displayed marketplace content using generated HTML. — content-scripts/csfloat.js:105-105