Is Editing Enhancer - Editing News & reLynth safe?
We analyzed Editing Enhancer - Editing News & reLynth version 2.0.4's actual code and gave it a 43/100 trust score. This extension is purpose-aligned for…
Bottom line
This extension is purpose-aligned for TikTok video tools, but its powerful permissions and server-controlled executable processing warrant substantial caution.
What it can access
The extension can change TikTok pages and uploads, observe TikTok activity, use stored session state, remove a specific TikTok cookie, start downloads, and send selected video and feature data to its service. [Q2] [Q4] [Q6] These capabilities broadly fit its stated TikTok editing purpose, but server
Signs of misuse
The strongest concern is that the service supplies WebAssembly that the extension executes, allowing remote responses to influence executable behavior. [Q7] [Q20] The review found no established password capture, browser-cookie copying, arbitrary page-data collection, or search and advertising abuse
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests broad browser capabilities, mainly for TikTok editing features, but the ability to execute server-supplied code and handle selected media makes the access more powerful than a simple page enhancer.
The manifest requests storage, tabs, scripting, activeTab, downloads, cookies, alarms, and declarativeNetRequest, with access covering TikTok-related sites, Editing News services, and localhost:5035. — manifest.json:1
Content scripts run on TikTok pages, including one script in the page's main context. — manifest.json:1
The extension reads its stored authentication/session state and makes authenticated requests to Editing News services. — assets/api-BH2XVW1y.js:1
Selected video data and server-supplied WebAssembly are processed during relevant service flows. — assets/index.ts-DRS5RNPd.js:66
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://tiktok.com/*, *://*.tiktok.com/*, *://tiktokcdn.com/*, *://*.tiktokcdn.com/*, *://byteoversea.com/*, *://*.byteoversea.com/*, http://localhost:5035/*, https://v2.editingnews.com/* — manifest.json:1
Content scripts run directly on: *://tiktok.com/*, *://*.tiktok.com/*, *://tiktok.com/*, *://*.tiktok.com/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The reviewed runtime code processes selected TikTok video files, but it does not show collection of passwords, payment fields, messages, or ordinary form entries. The page scripts are broad, yet no relevant sensitive-input capture path was established.
Content scripts run only on TikTok pages, including one MAIN-world script. — manifest.json:24-35
The identified page logic concerns TikTok upload interception and video processing, not general form-field collection. — assets/index.ts-DvNK-Z3m.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension uses extension storage and can remove a specific TikTok cookie when the user activates the subscribed-user tool. It can initiate downloads, but the reviewed code does not establish browsing-history, bookmarks, or downloads-history access.
Requests storage, tabs, cookies, and downloads permissions. — manifest.json:12-20
The popup calls chrome.cookies.remove for the ttwid cookie at www.tiktok.com. — assets/popup-CwjabS9v.js:9
Authentication/session state is read from extension storage and local storage. — assets/api-BH2XVW1y.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends account/session-related data, feature and heartbeat requests, TikTok statistics, and selected video-processing data outside the browser. Destinations include Editing News services and processing endpoints supplied by that service.
Defines authenticated requests to v2.editingnews.com for service operations. — assets/api-BH2XVW1y.js:1
Requests TikTok statistics and uploads or downloads video-processing data through service-provided endpoints. — assets/index.ts-DRS5RNPd.js:1,66
Transforms TikTok upload request bodies through the extension feature. — assets/index.ts-DvNK-Z3m.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The extension receives processing settings and heartbeat data from its service and instantiates WebAssembly bytes supplied by that service. It also follows server-provided upload, status, and result endpoints.
Server heartbeat data is decoded and supplied to WebAssembly.instantiate, whose exports are executed. — assets/index.ts-DRS5RNPd.js:66
Processing responses provide URLs, tokens, job status, and result locations used by the runtime. — assets/index.ts-DRS5RNPd.js:66
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension can send requests automatically during authentication, heartbeat, statistics, and enabled feature flows, and can perform popup- or feature-triggered tab, download, upload, and repost actions. It is not shown redirecting arbitrary searches.
Worker logic handles tab updates, messaging, downloads, and dynamic request-blocking rules. — assets/index.ts-CQgk_DVv.js:1
Feature code fetches repost data, sends removal requests, and performs processing-related network activity. — assets/index.ts-DRS5RNPd.js:1,35,66
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the shipped JavaScript is heavily minified/generated and because server-supplied WebAssembly is executed at runtime. This is an auditability issue, not by itself evidence of malicious behavior.
The large MAIN-world bundle is minified into a single line and hooks page APIs. — assets/index.ts-DvNK-Z3m.js:1
The popup bundle is a large generated/minified artifact. — assets/popup-CwjabS9v.js:1-9
Runtime WebAssembly bytes come from service responses. — assets/index.ts-DRS5RNPd.js:66
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct use of eval(), new Function(), or string-based timers was found in the inspected source. It does use WebAssembly.instantiate for server-provided WebAssembly, which is a separate dynamic-execution mechanism.
The inspected dynamic execution uses WebAssembly.instantiate rather than the requested JavaScript eval/new Function/string-timer APIs. — assets/index.ts-DRS5RNPd.js:66
Does it track the websites, pages, searches, or links you visit?
The extension observes TikTok tab URLs and page changes and uses selected video or author-page identifiers for statistics and feature requests. The evidence supports targeted TikTok activity tracking, not tracking every website.
Worker tab-update handling sends page-change messages. — assets/index.ts-CQgk_DVv.js:1
Feature logic uses the current location and requests data for recognized TikTok pages. — assets/index.ts-DRS5RNPd.js:58,66
Video and author statistics requests are tied to current TikTok-page data. — assets/index.ts-DvNK-Z3m.js:641,1112
Does it create a persistent ID or browser fingerprint to recognize you?
No browser fingerprint or persistent tracking ID was found. The code does create temporary request IDs, but they are for matching messages and are not shown being sent for tracking.
Generates random message IDs with Math.random() and Date.now() for request/response matching. — assets/index.ts-DvNK-Z3m.js:1
Stores an extension authentication session and userId, but no fingerprinting inputs or tracking use were found. — assets/api-BH2XVW1y.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends extension authentication/session data and selected page, statistics, and video-processing information to its service or processing endpoints. The reviewed code does not establish that browser cookies themselves or arbitrary page contents are copied out.
Authenticated API requests use extension-held session information. — assets/api-BH2XVW1y.js:1
Selected video data and feature/statistics information are sent through processing and service requests. — assets/index.ts-DRS5RNPd.js:66
TikTok upload bodies can be transformed when the upload feature is enabled. — assets/index.ts-DvNK-Z3m.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence was found that it records typing, form entries, clipboard contents, or screenshots. It does write text to the clipboard when the user clicks a tag or authentication-related copy control.
Copies a displayed tag to the clipboard after a user click; this is clipboard writing, not clipboard reading. — assets/index.ts-DvNK-Z3m.js:641
Uses navigator.clipboard.writeText for a user-requested copy action. — assets/popup-CwjabS9v.js:9
Can a website or remote server send commands that make the extension take actions?
A TikTok page can send defined window messages that the content script turns into extension-mediated fetch, download, transform, commit, or processing operations. Remote service responses also control feature behavior, subject to the extension's page and feature checks.
The content-script message handler supports fetch, download, transform, commit, and video-processing request types. — assets/index.ts-DRS5RNPd.js:66
Worker-side handlers expose proxy and repost/processing operations. — assets/index.ts-CQgk_DVv.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The reviewed code changes TikTok upload behavior and selected feature responses, but it does not establish modification of links, referral codes, advertisements, shopping carts, or search results. Those are the behaviors asked about here.
Hooks fetch/XMLHttpRequest for TikTok upload requests and rewrites selected feature or A/B responses. — assets/index.ts-DvNK-Z3m.js:1
A feature can block a TikTok local-video-sdk request. — assets/index.ts-CQgk_DVv.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension modifies selected TikTok upload requests, can block a TikTok request with declarative rules, and can initiate downloads. The reviewed code does not show proxy-setting changes or general request-header interception.
Page fetch and XMLHttpRequest behavior is replaced for targeted TikTok upload requests. — assets/index.ts-DvNK-Z3m.js:1
A declarative rule blocks a TikTok local-video-sdk request and worker logic handles downloads. — assets/index.ts-CQgk_DVv.js:1
The manifest requests downloads and declarativeNetRequest permissions. — manifest.json:12-20
Can it communicate with software on the computer or services running on localhost?
The manifest permits access to localhost:5035, but a permission alone does not prove communication. The reviewed runtime evidence does not establish a concrete localhost request or connection to software running on the computer.
Declares http://localhost:5035/* as a host permission. — manifest.json:31
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The runtime decodes remote heartbeat data, instantiates supplied WebAssembly, and executes its exported functions. This is executable hidden data supplied by the service, although the evidence does not show arbitrary native-code execution.
Remote token/heartbeat data is decoded and server-provided bytes are passed to WebAssembly.instantiate. — assets/index.ts-DRS5RNPd.js:1,66
The resulting WebAssembly exports are called during heartbeat processing. — assets/index.ts-DRS5RNPd.js:66
Can ordinary websites access privileged extension features through messaging or exposed files?
Code running in an allowed TikTok page can use the exposed window-message interface to request defined extension-mediated operations. This does not give arbitrary websites extension APIs: the scope is limited to matched TikTok pages and the supported message handlers.
Window messages can request fetch, download, transform, commit, and video-processing operations. — assets/index.ts-DRS5RNPd.js:66
The relevant content scripts and web-accessible resources are restricted to TikTok URL matches. — manifest.json:24-35
The handler checks the message source window but does not establish a stronger trusted sender identity within that page. — assets/index.ts-DRS5RNPd.js:66
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Several features activate only for recognized TikTok pages, stored session/subscription state, feature flags, verified remote tokens, or server heartbeat responses. The resulting behavior is conditional rather than uniformly active for every user and page.
Feature-token requests depend on recognized TikTok pages and stored account/subscription state. — assets/index.ts-CQgk_DVv.js:1
Feature activation and heartbeat behavior depend on remote responses and token verification. — assets/index.ts-DRS5RNPd.js:1,66
Upload behavior changes according to feature settings and flags. — assets/index.ts-DvNK-Z3m.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining implementation is established, but the extension performs recurring heartbeat computation and executes server-supplied WebAssembly, while video processing can consume substantial resources. The remote code prevents a definitive clean exclusion of hidden computation.
A recurring heartbeat flow executes server-provided WebAssembly and performs video-processing network work. — assets/index.ts-DRS5RNPd.js:1,66
Does it change form fields or where a form sends its information?
The extension replaces or transforms selected TikTok video upload data, including file and drag-and-drop upload paths. The reviewed code does not establish changes to ordinary form destinations or unrelated form fields.
Intercepts TikTok project/post requests and transforms their bodies. — assets/index.ts-DvNK-Z3m.js:1
Processes selected video files and substitutes processed files in upload flows. — assets/index.ts-DvNK-Z3m.js:1