Is Free Games safe?
We analyzed Free Games version 4.2's actual code and gave it a 88/100 trust score. Free Games appears narrowly scoped and purpose-aligned, with no…
Bottom line
Free Games appears narrowly scoped and purpose-aligned, with no demonstrated collection or browser control.
What it can access
It requests no special browser access and only displays games in its user-opened popup, fitting its stated purpose. [Q1]
Security weaknesses
Remote game content is isolated from extension privileges, and no website messaging or exposed privileged bridge is shown. [Q7][Q16][Q21]
Signs of misuse
It loads a fixed game page when opened, with no demonstrated collection of user data or hidden activity. [Q6][Q8][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Declares only metadata, icons, and a toolbar popup; permissions and host_permissions are absent. — manifest.json:1-18
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content_scripts, scripting permission, or website host access. — manifest.json:1-18
Contains only a resizable iframe and packaged popup.js. — popup.html:1-17
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Has no page-injection capability or relevant browser permission. — manifest.json:1-18
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests none of cookies, history, bookmarks, tabs, downloads, or storage. — manifest.json:1-18
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no permissions for device or local resources. — manifest.json:1-18
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Opening the popup connects to Indiexpo to load one embedded game; no extension-collected data is placed in the URL or a request body.
Selects one fixed https://www.indiexpo.net/embed/... URL and assigns it directly to iframe.src. — popup.js:1-262
Does it download or run code, settings, or instructions supplied by a remote server?
Live game code and content are supplied by Indiexpo inside a cross-origin iframe, but they do not run with extension privileges.
The extension popup contains a dedicated iframe. — popup.html:11-15
Every possible frame source is an HTTPS Indiexpo embed page. — popup.js:1-262
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The popup immediately chooses and loads a random game when the user opens it; it performs no background action while closed.
Randomly indexes the packaged list and immediately sets iframe.src. — popup.js:259-262
The script is reachable only through the user-opened action popup and there is no background worker. — manifest.json:14-17
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no overrides or settings-related capabilities. — manifest.json:1-18
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains an unobfuscated list of 255 URLs followed by straightforward random selection. — popup.js:1-262
Records only 32,798 unpacked bytes across nine files. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Only stores fixed strings, chooses an index, obtains the iframe, and sets its source. — popup.js:1-262
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Has no tabs, history, content-script, or host access. — manifest.json:1-18
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Uses Math.random only to select the current game and does not store or transmit an identifier. — popup.js:1-262
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
The only outbound action is loading a fixed Indiexpo URL with no appended user or browser data. — popup.js:259-262
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests no capture, clipboard, scripting, or page access. — manifest.json:1-18
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no background worker, externally_connectable, or web-accessible bridge. — manifest.json:1-18
Registers no message or navigation listener. — popup.js:259-262
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Cannot inject into websites. — manifest.json:1-18
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no request, download, or proxy capabilities. — manifest.json:1-18
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Has no nativeMessaging or localhost access. — manifest.json:1-18
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All remote destinations are explicit plaintext URLs used only as iframe sources. — popup.js:1-262
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable or web_accessible_resources entry and has no privileged handler. — manifest.json:1-18
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Chooses uniformly from the fixed local list without consulting identity, time, page, or server settings. — popup.js:259-262
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Has no background worker. — manifest.json:1-18
Local work is limited to one random selection and iframe assignment. — popup.js:259-262
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Has no website execution capability. — manifest.json:1-18
Its own popup contains no form, only an iframe. — popup.html:11-15