Is Video Quality Fixer for YouTube safe?
We analyzed Video Quality Fixer for YouTube version 0.0.13's actual code and gave it a 92/100 trust score. This appears to be a narrowly focused YouTube…
Bottom line
This appears to be a narrowly focused YouTube quality tool with no evidence of misuse or serious security weakness.
What it can access
It can read and change YouTube player controls and save quality preferences, matching its purpose, but this is still site content access. [Q1][Q2]
Security weaknesses
The package shows no remote code execution or website-controlled commands; a large minified interface slightly reduces inspectability. [Q7][Q10][Q11][Q16]
Signs of misuse
No evidence shows tracking, sensitive-data collection, traffic manipulation, or suspicious conditional behavior. [Q6][Q12][Q14][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and access to YouTube only; both directly support its saved preference and quality-changing feature.
Declares storage and host/content-script access limited to https://www.youtube.com/*. — manifest.json:3-42
Which websites can it run on, and can it read or change what appears on those pages?
It reads YouTube's player-menu labels and clicks the settings, quality and resolution items; it cannot access unrelated sites.
Queries .ytp settings-menu elements, reads their displayed resolution text and clicks the configured match. — assets/content-script.ts-ChRsIKdu.js:1
Limits the content script and host permission to YouTube. — manifest.json:11-31
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Website code touches only player controls and video/play events, not inputs or keystrokes. — assets/content-script.ts-ChRsIKdu.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores two local quality preferences and does not access cookies, browser history, bookmarks or downloads.
Persists only settings containing quality and shouldUseEnhancedBitrate through chrome.storage.local. — assets/index-CEM7gAav.js:1
Only the storage permission is declared. — manifest.json:27-31
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No corresponding device or data permission is requested. — manifest.json:27-31
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains only local DOM automation and extension messaging, with no fetch/XHR/beacon/WebSocket call. — assets/content-script.ts-ChRsIKdu.js:1-2
Reads local settings and messages YouTube tabs; it has no remote endpoint. — assets/background.ts-rnRSTlCC.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Imports only the packaged background module. — service-worker-loader.js:1
Loads settings exclusively from chrome.storage.local. — assets/background.ts-rnRSTlCC.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically clicks YouTube's quality controls when videos load or navigation changes, which is exactly the configured feature.
On watch/live pages, retries opening the settings menu and clicks the matching resolution; also responds to video play events. — assets/content-script.ts-ChRsIKdu.js:1
Notifies the tab when its URL changes so the quality selection can run again. — assets/background.ts-rnRSTlCC.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-settings, search or proxy permission is present. — manifest.json:27-31
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The popup uses a large minified React, Redux and Material UI bundle, although the security-relevant background and content logic is short and readable.
A roughly 275 KB minified UI bundle contains React and Material UI code. — assets/popup.html-CSqyZzC_.js:1-63
The actual page automation is a roughly 2.3 KB bundle. — assets/content-script.ts-ChRsIKdu.js:1-2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Timers receive function callbacks; no dynamic code construction exists. — assets/content-script.ts-ChRsIKdu.js:1-2
Function.toString inspection in bundled libraries is not code execution, and no eval/new Function call is present. — assets/index-CEM7gAav.js:1-17
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses tab URL changes only as a trigger to notify that tab and does not store or send the URL. — assets/background.ts-rnRSTlCC.js:1
No history permission is requested. — manifest.json:27-31
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Random strings belong to Redux internal action names and are neither persisted nor transmitted. — assets/index-CEM7gAav.js:1
No remote request or identifier field exists. — assets/background.ts-rnRSTlCC.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Reads only player-menu resolution labels and has no network sink. — assets/content-script.ts-ChRsIKdu.js:1-2
No cookies permission is declared. — manifest.json:27-31
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No keyboard, input, paste, clipboard or capture listener exists. — assets/content-script.ts-ChRsIKdu.js:1-2
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable rule exposes runtime messaging to websites. — manifest.json:3-42
Its message listener supports only internal content-loaded and settings-changed messages. — assets/background.ts-rnRSTlCC.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Only YouTube player setting menu elements are clicked. — assets/content-script.ts-ChRsIKdu.js:1-2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads or proxy permission is declared. — manifest.json:27-31
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission or localhost host access exists. — manifest.json:27-34
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All executed logic is packaged, direct DOM automation. — assets/content-script.ts-ChRsIKdu.js:1-2
Loads the packaged background module directly. — service-worker-loader.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Lists the content-script bundle as a web-accessible resource for YouTube with use_dynamic_url false. — manifest.json:32-42
No externally_connectable entry grants a page access to extension runtime APIs. — manifest.json:3-42
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Route checks are fixed to /watch and live-video paths needed for the feature. — assets/content-script.ts-ChRsIKdu.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Short polling loops stop after finding YouTube controls or after three seconds. — assets/content-script.ts-ChRsIKdu.js:1-2
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
DOM changes are limited to a temporary body class and clicks on YouTube player menu controls. — assets/content-script.ts-ChRsIKdu.js:1-2