Is Looper for YouTube safe?
We analyzed Looper for YouTube version 5.18.2's actual code and gave it a 84/100 trust score. Looper has purpose-aligned YouTube access, with a limited…
Bottom line
Looper has purpose-aligned YouTube access, with a limited page-sharing weakness but no established abusive behavior.
What it can access
It runs on all YouTube pages and reads playback-related page information while storing loop preferences, which fits its purpose but covers an entire site. [Q1][Q2]
Security weaknesses
YouTube page code can request limited loop settings and receive installation and private-browsing status, creating a bounded information-sharing weakness. [Q21]
Signs of misuse
No misuse is established: it opens a fixed update page and loads only packaged resources, with no evidence of tracking visited sites. [Q6][Q7][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can run on all YouTube pages and use extension storage, but not on unrelated sites.
Injects script.js and CSS on youtube.com and requests storage only. — manifest.json:5-15,34-41
Which websites can it run on, and can it read or change what appears on those pages?
It reads YouTube's player, current video metadata, page language, and loop-related URL state.
Finds YouTube player and page elements, reads video ID and title changes, and parses the current URL. — contentscript.js:216-240,2413-2456
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Observed page data is limited to playback UI, video metadata, language, and loop state. — contentscript.js:216-240,2413-2456
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores loop, shortcut, quality, display, and changelog preferences in Chrome sync storage.
Reads, validates, and writes only documented Looper preference fields. — options.js:169-267,275-356
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests only storage. — manifest.json:34-41
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
After an extension update it may open the vendor changelog, but no watched-video or account data is included by the extension.
Compares the installed version and opens a fixed alvinhkh.com changelog URL unless the user disabled that option. — script.js:8-23
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The only fetch loads a packaged locale JSON file from the extension origin. — contentscript.js:117-143
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Configured auto-looping and an update changelog can run automatically; both are visible, bounded product behavior.
Loop behavior follows URL and stored options and attaches to the YouTube player. — contentscript.js:719-856,1912-1937
The update notice can open automatically and has a saved opt-out. — script.js:8-23
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings or network-settings permission. — manifest.json:34-41
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Retains descriptive functions, comments, validation, and feature logic. — contentscript.js:1-2456
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The extension-page CSP restricts scripts to packaged self resources. — manifest.json:16-23
Injects the packaged contentscript.js resource, not remote code. — script.js:26-31
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Parses and updates loop, timer, start, and end parameters with history.replaceState. — contentscript.js:239-266,719-856
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Network-related behavior is limited to opening a fixed changelog; storage fields are feature preferences. — script.js:8-180
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads YouTube's PREF cookie for language and writes YouTube display cookies, but does not access authentication cookies or send cookies elsewhere.
Reads PREF as a language fallback and writes wide=0 or wide=1 for player layout. — contentscript.js:17-20,216-223,1443-1508
A helper for VISITOR_INFO1_LIVE exists but has no call site in the analyzed package. — contentscript.js:53-59
Does it record typing, form entries, clipboard contents, or screenshots?
It listens for one playback shortcut while explicitly ignoring inputs, textareas, editable content, and text boxes.
Rejects modified keys and typing targets, then compares only the pressed key to the configured shortcut or r. — contentscript.js:2217-2230
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote instructions are not fetched; behavior comes from packaged code, user options, and YouTube state. — contentscript.js:117-143
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Builds the loop UI and applies user-selected playback and layout behavior. — contentscript.js:247-266,1300-1349,1351-1508,1912-1937
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:34-41
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:34-41
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches only packaged locale messages through the extension URL. — contentscript.js:117-143
Can ordinary websites access privileged extension features through messaging or exposed files?
Its YouTube page bridge exposes installation and incognito-state information and lets page scripts request low-sensitivity loop preferences.
Writes chromePage and inIncognito to page sessionStorage and answers any same-window requestMessage with validated loop preferences. — script.js:33-85,162-180
Accepts optionsMsg only from a YouTube origin and validates enumerated values before changing page-local behavior. — contentscript.js:2233-2290
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Visible option controls persist the corresponding validated preferences. — options.js:275-356
Page controls manage loop count, timing, and portion settings. — contentscript.js:719-856,946-1260
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Repeated work consists of player event handling and bounded playback timers. — contentscript.js:1912-1937
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Its keyboard handler deliberately avoids form and editable inputs. — contentscript.js:2217-2230