Is Foot Star Sports Game safe?
We analyzed Foot Star Sports Game version 1's actual code and gave it a 86/100 trust score. This appears to be a low-risk, purpose-aligned game extension…
Bottom line
This appears to be a low-risk, purpose-aligned game extension with minor concerns about automatic page opening and packaged code execution.
What it can access
It requests no browser or website access and only opens its packaged game plus a fixed vendor page, fitting its stated purpose. [Q1]
Security weaknesses
It opens pages without a fresh request during installation or removal, which may surprise users; no broader control weakness is shown. [Q8]
Signs of misuse
No evidence shows tracking, sensitive-data collection, remote commands, or other misuse; automatic vendor-page visits are the main concern. [Q6][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can open its own sandboxed game page and create tabs, but requests no browser permissions or host access.
Declares a background worker and sandboxes Game_Source/index.html, with no permissions or host_permissions. — manifest.json:1-23
Creates tabs for the packaged game and the fixed vendor game URL. — background.js:1-9
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, scripting permission, activeTab, or host access. — manifest.json:1-23
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The game is isolated in a sandbox and there is no website injection path. — manifest.json:1-23
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The game runtime can use storage local to its sandboxed game origin for game state and offline assets.
Packaged Construct runtime includes local storage and asset-management facilities for the game. — Game_Source/scripts/c3runtime.js:1-1894
The game page is a sandboxed page without extension API privileges. — manifest.json:17-21
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests no relevant permissions. — manifest.json:1-23
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains packaged game layouts and event logic without remote endpoints. — Game_Source/data.json:1
External behavior only opens a fixed public vendor page; it does not send a payload. — background.js:1-13
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Game content and rules are packaged locally. — Game_Source/data.json:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Installation automatically opens the packaged game and the vendor website, and uninstall is configured to open the vendor page.
onInstalled creates two tabs and setUninstallURL points to https://pickergame.com/play/foot-star. — background.js:6-13
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings permissions. — manifest.json:1-23
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Identifies itself as generated by Construct and retains recognizable runtime modules. — Game_Source/scripts/c3runtime.js:1
Contains a recognizable packaged Emscripten Box2D loader paired with box2d.wasm. — Game_Source/box2d.wasm.js:1-73
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
Packaged Box2D code uses fixed-string eval and contains a fixed-path asm.js fallback; remote or attacker-controlled text reaching eval was not demonstrated.
Evaluates two constant library strings to initialize Box2D and normalize a native gc symbol. — Game_Source/box2d.wasm.js:5,9
Legacy fallback can eval text read from fixed Box2D_v2.3.1_min.wasm.temp.asm.js, while the configured path is native-wasm and the package supplies local box2d.wasm. — Game_Source/box2d.wasm.js:33-39
The game runs in a sandbox rather than a privileged extension page. — manifest.json:17-21
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no tabs, history, webNavigation, or host access. — manifest.json:1-23
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Vendor URLs contain no identifier or query payload. — background.js:1-13
No tracking or analytics endpoint is present. — Game_Source/data.json:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or website access and sandboxes the game page. — manifest.json:1-23
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Input handling belongs to the packaged soccer game and is not transmitted. — Game_Source/data.json:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Game behavior is packaged locally with no remote instruction endpoint. — Game_Source/data.json:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content scripts or scripting permission are declared. — manifest.json:1-23
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no network-control or downloads permission. — manifest.json:1-23
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:1-23
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads packaged Box2D, support, offline, main, and service-worker scripts. — Game_Source/index.html:27-37
Loads project scripts, WebAssembly, data.json, and styles through project-file URLs in the packaged game. — Game_Source/scripts/c3runtime.js:824-825,1805-1809
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or externally_connectable interface. — manifest.json:1-23
Message ports coordinate packaged Construct workers only. — Game_Source/scripts/jobworker.js:1-8
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Contains local game input and level behavior. — Game_Source/data.json:1
Automatic navigation is limited to the fixed vendor game page. — background.js:6-13
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Loads the paired Box2D WebAssembly module for game physics. — Game_Source/box2d.wasm.js:1-73
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
It cannot inject into external pages. — manifest.json:1-23