Is Dark Mode safe?
We analyzed Dark Mode version 2.3.0's actual code and gave it a 68/100 trust score. This is a broadly accessible dark-mode extension with no demonstrated…
Bottom line
This is a broadly accessible dark-mode extension with no demonstrated misuse, but its traffic-control permissions are unnecessarily powerful and partly unresolved.
What it can access
It can run on essentially every website and change page appearance, which fits a global dark theme, but it also requests broad traffic-monitoring and blocking powers beyond that feature. [Q2] [Q18] The reviewed code shows no access to passwords, form entries, cookies, or browsing history. [Q3] [Q4]
Signs of misuse
The reviewed package shows no collection of form data, cookies, page contents, browsing history, or persistent tracking identifiers, and no outside information transfer was found. [Q3] [Q4] [Q6] [Q12] Traffic modification is not demonstrated, although the relevant permissions and incomplete codeS?
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests access across nearly all websites, including the ability to modify pages and monitor or block web traffic. Broad page access fits a global dark theme, but the traffic permissions are more powerful than that purpose requires.
Requests context menus, tabs, webRequest, webRequestBlocking, webNavigation, storage, and access to all URLs; content scripts run on all URLs and in all frames. — manifest.json:1
The reviewed page code adds and maintains stylesheets and uses local theme and whitelist settings; it does not read form contents. — data/content_script/inject.js:31-57, 68-102
The context-menu feature adds the current site to a local exclusion list. — lib/common.js:27-43
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*/* — manifest.json:1
Content scripts run directly on: <all_urls> — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The reviewed runtime code does not read form fields, keystrokes, passwords, payment details, messages, or submitted form data. Its page script only uses the current URL and manages CSS.
Uses document.location.href, storage settings, and stylesheet elements; no form or input-value access is shown. — data/content_script/inject.js:4-7, 59-102
The background message handler returns the sender tab URL for frame coordination, not page form data. — lib/chrome/chrome.js:1-6
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No code was found reading cookies, browsing history, bookmarks, downloads, or website session data. The listed permissions include tabs and web-request privileges, but the reviewed implementation does not use them for those purposes.
Lists tabs, webRequest, webNavigation, and storage permissions. — manifest.json:39-48
The implemented storage access is extension-local storage for settings, not cookies or browser history. — lib/chrome/chrome.js:30-49
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No external information-transfer endpoint was found in the reviewed runtime code. The only fetch found loads a bundled options-page JSON file, and the extension stores settings locally.
Fetches the relative resource explore/explore.json and parses it for the options page. — data/options/explore/explore.js:17-17
Settings are read from and written to chrome.storage.local. — lib/chrome/chrome.js:30-49
Does it download or run code, settings, or instructions supplied by a remote server?
The reviewed code does not download or execute JavaScript or settings from a remote server. The options page loads a packaged JSON resource and builds links from its contents.
Loads relative explore.json and uses its id/title values to create ordinary links. — data/options/explore/explore.js:17, 78-103
The declared CSP allows extension-local scripts and unsafe-eval, but no runtime remote-code loader was found. — manifest.json:49-50
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It can open tabs, but the reviewed paths are tied to explicit user actions in the options page or extension installation/update behavior. It also adds a context-menu action that changes the site whitelist when selected.
Provides a background function to create an active tab and returns a sender tab URL for frame coordination. — lib/chrome/chrome.js:5-6
Creates the exclusion context menu and opens pages only through registered option commands. — lib/common.js:27-41, 45-53
Opening test, new-tab, support, donation, and whitelist changes are wired to option-page user events. — data/options/options.js:80-102
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The extension includes a vendor editor library and dynamically loads its packaged common.js code, but the available code is readable and these mechanisms do not establish hidden or heavily obfuscated behavior. No important runtime behavior is shown to be concealed from inspection.
A bundled options-page editor library is present; being third-party or sizable does not by itself make its behavior hidden. — data/options/vendor/behave.js:1-10
The background page explicitly loads config.js and chrome.js. — lib/chrome/background.html:5-6
The background dynamically appends ../common.js after reading storage, but this is a packaged, identifiable script path rather than generated or opaque code. — lib/chrome/chrome.js:30-49
The manifest identifies the background page, content scripts, and options page; no obfuscated or remotely supplied script is declared. — manifest.json:1-39
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No eval(), new Function(), or string-based timers were found in the searched source. Timers use function or arrow-function callbacks.
setTimeout receives function callbacks. — lib/chrome/chrome.js:9-16, 33-39
The options timer receives a function callback. — data/options/explore/explore.js:1-1
The timer receives an arrow-function callback. — lib/pop.js:193-198
Does it track the websites, pages, searches, or links you visit?
It reads the current page URL to choose matching dark-mode CSS and to manage the user’s whitelist, but no evidence shows that it records or transmits browsing history, searches, pages, or links.
Reads document.location.href and tests it against local theme rules and whitelist entries. — data/content_script/inject.js:4, 68-88
Uses the selected page URL only to add its hostname to the local exclusion list. — lib/common.js:33-41
Does it create a persistent ID or browser fingerprint to recognize you?
No persistent identifier or browser-fingerprint collection is shown. The extension stores preferences such as theme state and whitelisted hostnames, not a tracking ID.
Reads local theme and whitelist settings and uses the current page hostname only to decide which stylesheet to apply. — data/content_script/inject.js:68-102
Persists extension settings in chrome.storage.local; no generated identifier or fingerprint is created. — lib/chrome/chrome.js:30-49
Does it send cookies, session details, authentication data, or page contents elsewhere?
No code was found that reads cookies, sessions, authentication data, or page contents and sends them elsewhere. The only network request identified loads a bundled local JSON file in the options page.
fetch("explore/explore.json") loads extension-local content. — data/options/explore/explore.js:17-17
Uses storage settings and the page URL hostname only; it does not read page text, cookies, or form data. — data/content_script/inject.js:68-102
Does it record typing, form entries, clipboard contents, or screenshots?
The extension does not record typing, form entries, clipboard data, or screenshots. Its keyup handler is limited to saving the user’s custom CSS in extension storage.
A keyup listener saves the custom-style textarea value to local storage; it is not sent to a server. — data/options/options.js:93-94
The content script creates stylesheets and observes DOM mutations to keep its stylesheet attached. — data/content_script/inject.js:31-57
Can a website or remote server send commands that make the extension take actions?
The extension accepts runtime messages, but the demonstrated messages are from its own content script or options page and perform limited actions. There is no shown remote command channel, though broad web access and incomplete library coverage prevent a definitive exclusion.
A message named "top" returns the sender tab URL to a content script. — lib/chrome/chrome.js:6-6
Options messages dispatch registered local UI callbacks. — lib/chrome/chrome.js:55-69
Registered callbacks only open fixed support, test, donation, or new-tab URLs. — lib/chrome/chrome.js:50-53
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No link, referral-code, advertisement, shopping-cart, or search-result modification is shown. The extension mainly injects dark-theme CSS.
Creates link/style elements for stylesheets. — data/content_script/inject.js:31-45
UI actions open fixed pages; no page links or shopping behavior are rewritten. — lib/sli.js:27-53
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The manifest requests webRequest and webRequestBlocking permissions, but the reviewed executable code contains no webRequest listeners or traffic modification. Because relevant code coverage is not complete, this cannot be treated as fully ruled out.
Requests webRequest, webRequestBlocking, webNavigation, and broad URL access. — manifest.json:44-48
Uses a context menu to add the clicked page hostname to a local whitelist, not to alter traffic. — lib/common.js:27-43
Can it communicate with software on the computer or services running on localhost?
No native-messaging connection, localhost request, or communication with computer software is shown.
Background code uses extension APIs, storage, messaging, and tab creation only. — lib/chrome/chrome.js:1-69
The only fetch shown targets an extension-local JSON resource. — data/options/explore/explore.js:17-17
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No active hidden-data unpacking followed by execution or injection is demonstrated in the extension’s main code. However, bundled library files are large and not fully traced, so this behavior cannot be conclusively excluded.
The extension loads bundled JavaScript and CSS, with unsafe-eval permitted by its CSP. — manifest.json:1-50
The demonstrated injection is stylesheet creation, not decoded executable code. — data/content_script/inject.js:31-45
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary webpages are not shown to have direct access to the extension's privileged APIs or files. The extension's content scripts can ask the background for their own tab URL, while the exposed web-accessible resources are CSS files and do not expose privileged extension functionality.
The background has a message handler for the literal top request and returns sender.tab.url; this supplies URL metadata to an extension message sender but performs no privileged action. — lib/chrome/chrome.js:3-6
The options message handler dispatches registered callbacks for options-to-background requests; the shown code does not expose a browser API directly to webpage JavaScript. — lib/chrome/chrome.js:53-69
Only data/content_script/*.css is web-accessible; no JavaScript or privileged background resource is exposed. — manifest.json:10-19
Content scripts run in isolated extension contexts on matching pages, including all frames, but this does not make the page main world an extension API caller. — manifest.json:21-39
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior varies with browser type, stored settings, whitelisted hosts, and installation/update timing, but no suspicious remote targeting or remote configuration is shown.
Default support behavior differs for Firefox and other browsers. — lib/config.js:13-20
Installation/update handling checks version and elapsed time, then only updates local welcome state. — lib/chrome/chrome.js:8-16
Theme behavior depends on locally stored settings and the current hostname. — data/content_script/inject.js:68-101
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency mining or other concealed resource-intensive computation is shown. The content script performs stylesheet setup and a DOM mutation observation.
Uses MutationObserver only to restore its stylesheet link if removed. — data/content_script/inject.js:47-57
The randomization code shuffles a small local list for an options-page display. — data/options/explore/explore.js:19-25
Does it change form fields or where a form sends its information?
No form fields or form destinations are changed. The extension’s demonstrated DOM changes add stylesheets and style elements only.
Creates a stylesheet link and style element for dark-mode presentation. — data/content_script/inject.js:31-45
Changes only the extension-created stylesheet link and style content. — data/content_script/inject.js:12-15