Is YouTube Audio Mode safe?
We analyzed YouTube Audio Mode version 2.4.0's actual code and gave it a 88/100 trust score. This appears to be a purpose-aligned YouTube audio extension…
Bottom line
This appears to be a purpose-aligned YouTube audio extension with limited site access and no established misuse.
What it can access
Access is limited to YouTube player pages and supports audio controls, while also storing usage totals and preferences.[Q1][Q2][Q4]
Security weaknesses
No meaningful security weakness is established: code is inspectable, uses packaged resources, and lacks remote command paths.[Q10][Q11][Q16]
Signs of misuse
There is no evidence of outside data sharing, browser-session collection, or downloaded code execution.[Q6][Q7][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can access YouTube watch, live, playlist, and embedded-player pages, but no unrelated sites.
Limits host permission and content-script matches to www.youtube.com player surfaces. — manifest.json:16-18,42-69
Which websites can it run on, and can it read or change what appears on those pages?
It reads YouTube player state, video title, channel name, and video ID to provide audio-mode and popup playback controls.
Reads YouTube title/channel elements, the video ID, and HTML video playback state. — content.js:888-940
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The returned page data is limited to public video metadata and playback state. — content.js:907-940
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores preferences in synchronized browser storage and retains daily active/listening totals locally for 90 days.
Aggregates five-second usage counters, prunes entries older than 90 days, and writes statsLogs/activeLogs to local storage. — content.js:640-714
Reads and writes display preferences in sync storage. — popup.js:758-877
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares storage, activeTab, scripting, webNavigation, and YouTube host access only. — manifest.json:10-18
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
The only fetch loads a packaged locale file through chrome.runtime.getURL. — content.js:115-125
Its only fetch also loads a packaged locale file. — popup.js:79-84
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads packaged translations and local settings only. — content.js:115-180
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
If audio mode is already enabled, it automatically applies the mode on matching YouTube pages and navigation events. This is expected product behavior.
Handles YouTube navigation and injects the packaged content script when saved audio mode is enabled. — background.js:121-171
Reads the saved audioMode preference and enables it on page load. — content.js:153-175
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings, proxy, or override permission. — manifest.json:10-18
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive names, comments, and straightforward DOM/player operations. — content.js:1-1000
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The packaged page-context helper contains only a fixed YouTube player event hook. — inject.js:1-16
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Filters navigation handling to www.youtube.com audio-mode surfaces. — background.js:121-171
Reads the current YouTube URL/video ID and detects YouTube single-page navigation. — content.js:888-904,948-1000
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores coarse listening and active-time totals only in chrome.storage.local. — content.js:640-714
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests neither cookies nor identity permissions. — manifest.json:10-18
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Handles extension playback commands and video events, not typed input or screenshots. — content.js:230-287
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Uses only packaged resources, saved settings, and a narrow local page event. — content.js:115-180
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Receives extension-only playback commands and applies audio mode to the YouTube video element. — content.js:243-287,289-388
Creates the audio-mode overlay over the player. — content.js:738-804
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no request-control, proxy, or downloads permission. — manifest.json:10-18
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:10-18
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Injects only the packaged inject.js file using chrome.runtime.getURL. — content.js:134-142
Restricts extension scripts to self and exposes the packaged helper only on YouTube. — manifest.json:77-91
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Forwards YouTube's playback-quality event through window.postMessage. — inject.js:3-16
Accepts only AM_QUALITY_CHANGE and sets a local boolean used to avoid overriding the user's quality choice. — content.js:144-151
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Saves user-selected color or image settings and sends them to the active YouTube tab. — popup.js:758-877
Applies the chosen value as the overlay background, causing a normal image request when the user chose a URL. — content.js:819-830
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Periodic work consists of small local usage counters and storage flushes. — content.js:640-714
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Its DOM insertion is a fixed player overlay with text labels and decorative elements. — content.js:738-804