Is BetterFloat safe?
We analyzed BetterFloat version 3.6.10's actual code and gave it a 78/100 trust score. BetterFloat appears purpose-aligned, but its wide marketplace…
Bottom line
BetterFloat appears purpose-aligned, but its wide marketplace access and difficult-to-audit code warrant caution.
What it can access
The extension can automatically read and change pages across many named skin-market and Steam-related sites, which fits its marketplace-enhancement purpose but covers a wide range of shopping pages. [Q2] It also has temporary active-page access and page-injection capability. [Q1]
Signs of misuse
The package sends marketplace and feature data to its own services, supported marketplaces, GamerPay, and GitHub for stated features. [Q6] No established password, cookie, browsing-history, form-entry theft, arbitrary remote command, or downloaded-code execution was found, though minification limits
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
BetterFloat can automatically read and change pages on many named CS2 skin-market websites, matching its advertised purpose, but this is broad access across numerous shopping and Steam-related sites.
The manifest lists page access for more than 25 skin-market, Steam, and related domains, plus automatic page integrations on many of them. — manifest.json:1
The scripting, activeTab, storage, notifications, and unlimitedStorage permissions support page modification, temporary active-page access, local data storage, and notifications. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.csfloat.com/*, *://*.skinport.com/*, *://*.skinbid.com/*, *://*.avan.market/*, *://*.bitskins.com/*, *://*.cs.money/*, *://*.dmarket.com/*, *://*.steamcommunity.com/* — manifest.json:1
Content scripts run directly on: *://*.avan.market/*, *://*.bitskins.com/*, https://*.buff.market/*, https://*.csfloat.com/*, https://*.cs.money/*, *://*.dmarket.com/*, *://*.gamerpay.gg/*, *://*.haloskins.com/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension runs content scripts on supported skin-market pages and processes their DOM and API responses, so it could encounter visible form data on those sites. I found no established path that reads passwords, payment details, messages, or arbitrary form entries and sends them elsewhere, but the minified bundles prevent a definitive negative conclusion.
Content scripts run automatically on listed marketplace domains, not on every website. — manifest.json:64-155
The script injects packaged page code and processes marketplace responses such as inventory and exchange-rate data. — content-scripts/csfloat.js:5-7
The script requests the site's own inventory endpoint with credentials included; this does not establish collection of typed credentials. — content-scripts/skinflow.js:100
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
I found no active use of cookie, history, bookmark, download-history, or password-manager APIs. Requests made from pages may naturally include that site's credentials, but that is not evidence that the extension extracts browser session data.
Declared permissions do not include cookies, history, bookmarks, downloads, or browsingData. — manifest.json:12-18
Search results show browser API type definitions, but no demonstrated call to cookie/history/bookmark/download APIs. — background.js:1-3
Site API requests and intercepted site responses concern marketplace inventory/listings data rather than browser-wide private data. — content-scripts/csfloat.js:7,116
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends and retrieves marketplace, pricing, subscription, and enhancement data over the network. Destinations include supported marketplaces, BetterFloat services, GamerPay, GitHub-hosted tier lists, and other site endpoints; the inspected requests are used for page features and cached data.
Fetches BetterFloat CDN blue-gem pattern data and caches it in extension storage. — background.js:1
Fetches CSFloat exchange data and tier-list JSON from GitHub. — content-scripts/csfloat.js:7,249
Fetches GamerPay currency rates and stores them locally. — content-scripts/gamerpay.js:126
Fetches the current site's inventory endpoint with same-site credentials. — content-scripts/skinflow.js:100
Does it download or run code, settings, or instructions supplied by a remote server?
The extension downloads remote JSON and other configuration or data, including pattern files, tier lists, marketplace data, and subscription responses. The reviewed paths inject only packaged extension scripts; I found no established execution of downloaded JavaScript.
Downloads JSON pattern data from the BetterFloat CDN and caches it. — background.js:1
Downloads JSON tier-list data from raw.githubusercontent.com and caches it. — content-scripts/csfloat.js:249
Injects a packaged resource obtained through the extension URL, rather than code fetched from a remote server. — content-scripts/csfloat.js:5
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension performs background requests and page enhancements without a separate click whenever its service worker or supported-site content script is active. Some refresh or clicking behavior is conditional on user settings, but automatic initialization and periodic feature work are established.
Background listeners and data-fetching handlers operate independently of a current page click. — background.js:1-3
Supported-page code includes automatic refresh or synchronization behavior. — content-scripts/csfloat.js:124,337
Includes timer- and page-state-driven refresh/click behavior. — content-scripts/dmarket.js:137,146
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the extension is distributed as heavily bundled and minified JavaScript, including multi-megabyte marketplace scripts and large generated libraries. This increases uncertainty when tracing all callers and data flows.
Background logic is compressed into a few dense lines. — background.js:1-3
A multi-megabyte bundled script combines extension logic with framework and library code. — content-scripts/csfloat.js:1-337
Many separate market-specific entry points require independent runtime analysis. — manifest.json:64-155
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
Literal searches found no active eval(), new Function(), or string-based timer execution in the extension's inspected source. Because much of the package is minified/generated, this is not an absolute guarantee.
No active eval/new Function/string-timer execution was identified in the inspected background code. — background.js:1-3
The inspected minified content script uses ordinary functions and timers; no confirmed string-to-code execution was found. — content-scripts/csfloat.js:1-337
Does it track the websites, pages, searches, or links you visit?
The extension observes and processes URLs, DOM content, and marketplace requests on its supported sites, but I found no established storage, correlation, or external transmission of a browsing history, searches, or links visited. Monitoring a supported page in memory is not by itself tracking.
Automatic content scripts are limited to listed marketplace domains. — manifest.json:64-155
Supported-page code monitors URL or page-state changes for feature behavior. — content-scripts/dmarket.js:146,155
Processes marketplace listings, inventory, sales, and related page data. — content-scripts/csfloat.js:116,282
Does it create a persistent ID or browser fingerprint to recognize you?
No code evidence shows a persistent user ID or browser fingerprint being created or sent for tracking.
Storage and cryptographic code is present, but no demonstrated fingerprint collection or tracking-ID use was found. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension makes same-site requests that may include the user's existing marketplace cookies, including an inventory request with credentials enabled. I found no established path that copies cookies, session tokens, authentication data, or page contents to an unrelated destination.
Requests the Skinflow inventory endpoint with credentials included and uses the returned inventory locally. — content-scripts/skinflow.js:100
Fetches and processes marketplace inventory and sales data, including same-site API data. — content-scripts/csfloat.js:7,116
Fetches BetterFloat service data, but the inspected path does not establish that cookies or page contents are included in those requests. — background.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence shows keystroke or form-entry logging, screenshot capture, or clipboard reading. Clipboard use found is limited to writing generated item names or commands after the user clicks.
Uses navigator.clipboard.writeText only to copy an item name or generated command. — content-scripts/csfloat.js:169,198
Clipboard-related event support is bundled library code, not demonstrated recording behavior. — chunks/style-CeRv0mI5.js:8
Can a website or remote server send commands that make the extension take actions?
The package declares external messaging for pages matching rums.dev, but the background listener additionally requires the sender origin to be exactly https://betterfloat.com/. Because that origin does not match the declared external-connectability pattern, the cited remote-command path is not established.
External connections are declared for https://*.rums.dev/*. — manifest.json:47-52
The external-message listener rejects senders whose origin is not exactly https://betterfloat.com/ and only then applies newSettings. — background.js:3
The apparent onMessageExternal API text is part of bundled browser-polyfill code, not by itself proof of a reachable external command handler. — content-scripts/avanmarket.js:4
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The extension changes supported marketplace pages by adding comparison prices, links, badges, and market-related UI. This appears to be its advertised shopping-market enhancement rather than hidden advertising or referral manipulation.
Adds marketplace links, generated-item controls, and comparison-related UI. — content-scripts/csfloat.js:105,198,307
Injects market comparison prices and links into marketplace item displays. — content-scripts/avanmarket.js:54-102
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No extension webRequest permission or proxy-setting code is present, and no evidence shows general traffic or headers being modified. Supported pages do intercept their own XHR/fetch responses for display purposes.
Permissions do not include webRequest, proxy, or downloads. — manifest.json:1
Wraps page XHR and fetch to inspect supported-site responses and dispatch data to the content script. — betterfloat-main.js:1-2
Can it communicate with software on the computer or services running on localhost?
No code evidence shows communication with native computer software or localhost services.
No nativeMessaging permission is declared. — manifest.json:1
The localhost/127.0.0.1 reference is part of bundled database-library environment detection, not an extension connection. — content-scripts/csfloat.js:7
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The package contains cryptographic and decoding routines, but their presence does not prove that hidden remote content is decrypted and executed. The established injection path loads packaged extension resources, and no complete decrypt-then-execute path was found.
Contains bundled cryptographic or encoding routines, without an established execution path from decrypted output to code evaluation. — background.js:1
Creates a page script element using an extension URL and appends the packaged resource. — content-scripts/csfloat.js:5
Lists packaged main-world resources as web-accessible files. — manifest.json:1-2
Can ordinary websites access privileged extension features through messaging or exposed files?
Web-accessible files can be loaded by matching marketplace pages, but that does not grant those pages privileged extension APIs. The apparent external-message route is blocked by the mismatch between the manifest's rums.dev pattern and the background listener's exact betterfloat.com origin check.
Allows external connections only from https://*.rums.dev/* and exposes selected packaged resources to listed marketplace domains. — manifest.json:47-52
Rejects external messages unless sender.origin is exactly https://betterfloat.com/; accepted messages only write synchronized settings. — background.js:3
Bundled polyfill references messaging APIs, but the cited page-side handlers are not proof that an ordinary website receives extension privileges. — content-scripts/avanmarket.js:4
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior is conditional on supported websites, page state, user settings, subscription status, and marketplace data. This is consistent with feature targeting, not proof of covert targeting.
Content scripts are restricted to named skin-market and related domains. — manifest.json:1
Features depend on stored settings, item conditions, and a Pro-plan check. — content-scripts/csfloat.js:186,249
Inventory processing occurs only when site/login state permits it. — content-scripts/skinflow.js:100
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No mining loop, proof-of-work behavior, or other concealed resource-intensive computation was found.
Particle effects are bundled UI animation code, not evidence of cryptocurrency mining. — chunks/Container-DirFs7TF.js:1
Does it change form fields or where a form sends its information?
The inspected code adds marketplace UI and links but does not demonstrate changing form destinations or secretly rewriting form fields.
Changes displayed item content and adds click controls, not form submission targets. — content-scripts/csfloat.js:105,198
No declarative rules or permissions indicate form or navigation rewriting. — manifest.json:1