Is Video Enhancer for YouTube™ safe?
We analyzed Video Enhancer for YouTube™ version 2.0.0's actual code and gave it a 88/100 trust score. This appears to be a purpose-aligned YouTube video…
Bottom line
This appears to be a purpose-aligned YouTube video tool with limited access and no evidence of misuse.
What it can access
It can alter YouTube video pages and store settings, which fits its stated video-enhancement purpose but still gives it page-level access.[Q1][Q2][Q4]
Security weaknesses
The package is minified, creating modest review uncertainty, but no dangerous code execution or exposed privileged control was found.[Q10][Q11][Q21]
Signs of misuse
No evidence shows data collection, remote commands, tracking, traffic manipulation, or other misuse beyond its video-enhancement function.[Q6][Q14][Q16][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and access to YouTube pages only. It does not request all-site access or sensitive browser permissions.
Requests storage and *://*.youtube.com/* only. — manifest.json:permissions and host_permissions
Which websites can it run on, and can it read or change what appears on those pages?
It changes the YouTube video element's CSS filters, playback rate, audio path, loop/current-time state, and picture-in-picture mode.
Targets video.video-stream and applies video/audio controls received from the popup. — scripts/content-script.js:VideoEnhancer methods
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The only page lookup is document.querySelector('video.video-stream'); subsequent access is limited to media and style properties. — scripts/content-script.js:entire file
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores popup appearance preferences locally and temporary filter/loop settings in session storage, sometimes keyed by the active YouTube URL. It has no cookie, history, bookmark, or download access.
Uses chrome.storage.session for per-URL or global video options. — scripts/popup.js:updateVideoFilter, updateVideoOption, initialization
Uses chrome.storage.local for font and color preferences. — scripts/options.js:Options methods
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Only storage is requested. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
No fetch, XMLHttpRequest, WebSocket, sendBeacon, or remote endpoint is present. — scripts/*.js:complete network review
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Background, content, popup, options, fonts, icons, and SVG assets are local package files. — manifest.json:entry points
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
VideoEnhancer.getInstance is called only after a popup message arrives. — scripts/content-script.js:runtime.onMessage listener
Performs local settings initialization or migration only. — scripts/service_worker.js:onInstalled
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No relevant browser-settings or management permission is requested. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The four small scripts are minified, but identifiers and logic remain readable and the entire executable package is only about 19 KB of JavaScript. No hidden data or deliberate concealment was found.
Build output is compacted to one line but retains class methods, string names, and straightforward control flow. — scripts/*.js:entire files
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses ordinary classes, callbacks, DOM APIs, and Chrome APIs only. — scripts/*.js:complete dangerous-code primitive review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses chrome.tabs.query and selects r[0].url or 'global' as the chrome.storage.session key. — scripts/popup.js:popup initialization and storage key selection
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores only video/UI settings and creates no unique identifier. — scripts/*.js:storage and network review
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookie permission, credential fields, authentication API, or network path exists. — manifest.json and scripts/*.js:permissions and complete code
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers only video loadedmetadata/timeupdate handlers and a Chrome runtime-message listener. — scripts/content-script.js:entire file
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No network requests or remotely controlled configuration are present. — scripts/*.js:complete network review
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Only the existing YouTube video element is modified. — scripts/content-script.js:page modification logic
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, debugger, or downloads permission is requested. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission, localhost endpoint, or process-control path exists. — manifest.json and scripts/*.js:complete review
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Inputs are numeric video controls, time strings, booleans, and local color/font settings. — scripts/*.js:complete data-flow review
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Listens to Chrome extension runtime messages and has no page-event or window-message bridge. — scripts/content-script.js:runtime.onMessage listener
No external runtime-message access is declared. — manifest.json:externally_connectable
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches map directly to filter, loop, picture-in-picture, and reset controls. — scripts/content-script.js and scripts/popup.js:option branches
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runtime work is limited to media properties, CSS filters, Web Audio gain, simple UI, and session storage. — scripts/*.js:complete compute review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Applies user-selected visual, playback, audio, looping, and picture-in-picture changes to the video. — scripts/content-script.js:setFilter, setPlaybackRate, setVolume, setLoop, setPipMode