Is Themes for Facebook safe?
We analyzed Themes for Facebook version 3.2.5's actual code and gave it a 86/100 trust score. This appears to be a purpose-aligned Facebook theme…
Bottom line
This appears to be a purpose-aligned Facebook theme extension with moderate site access and no established abuse.
What it can access
It can store theme choices and alter pages on Facebook and fb.zone, which fits its wallpaper purpose but still grants site-scoped page access. [Q1][Q2]
Security weaknesses
No concrete security flaw is established; the fb.zone page can manage only listed theme actions through checks and fixed sources. [Q16][Q21]
Signs of misuse
No evidence shows it steals private data or tracks browsing; its outside requests are for themes, media, and optional fonts. [Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage plus access to Facebook and fb.zone. The scope is limited to the two services needed to choose and apply Facebook themes.
Declares storage, HTTPS fb.zone host access, and content scripts only on fb.zone and facebook.com. — manifest.json:13-37
Which websites can it run on, and can it read or change what appears on those pages?
On Facebook it reads structural roles, dimensions and existing color tokens, watches page changes, and changes visual styling by injecting CSS, fonts, images and videos.
Reads computed CSS tokens and identifies chat surfaces from DOM roles and dimensions. — js/content/content.js:89-129
Injects generated styles, a validated Google Font link and selected background elements. — js/content/content.js:440-524, 673-813
Observes page DOM changes to keep chat surfaces and theme presentation correct. — js/content/content.js:905-915
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Input references are generated colors such as --input-background and --input-border-color; no value or keystroke access occurs. — js/content/content.js:220-310
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
None of the cookies, history, bookmarks or downloads permissions is declared. — manifest.json:13-37
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Only storage and narrowly scoped website access are present. — manifest.json:13-37
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It requests theme JSON, images and videos from fb.zone and optional font CSS from Google Fonts. These requests expose normal network metadata such as IP address and user agent, but no Facebook posts, messages or field values are sent.
Fetches a selected theme record from https://fb.zone/api/themes/<id> with credentials omitted. — js/content/content.js:959-966
Streams selected HTTPS fb.zone media with credentials omitted after validating the host. — js/background/init.js:102-145
Adds Google Fonts CSS only for a strictly validated selected font family. — js/content/content.js:480-524
Does it download or run code, settings, or instructions supplied by a remote server?
Theme settings and visual assets come from fb.zone, and optional font rules come from Google. They influence appearance but are validated and never treated as JavaScript or raw HTML.
Theme colors are parsed, font names match a strict pattern, and media URLs must be HTTPS fb.zone hosts. — js/content/content.js:141-206
Generated CSS is assigned with textContent rather than innerHTML. — js/content/content.js:440-449
Remote theme fields are parsed and passed through the constrained CSS/media paths. — js/content/content.js:872-902
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
A saved theme is automatically applied when Facebook loads and updated across open tabs. This page modification is the advertised feature.
Loads the saved theme automatically, reacts to storage and route changes, and applies visual modifications. — js/content/content.js:917-921, 1015-1059
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser settings-control permission is declared. — manifest.json:13-37
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Complete readable service worker with explicit validation and media limits. — js/background/init.js:1-148
Complete readable theme engine with named routines and documented trust boundaries. — js/content/content.js:1-1061
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The only interval uses an arrow-function callback to detect route changes. — js/content/content.js:1054-1059
The small package inventory contains only the reviewed first-party scripts and static assets. — inventory.json:1-90
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
location.pathname is compared locally; no network transmission uses it. — js/content/content.js:838-852, 1044-1059
Does it create a persistent ID or browser fingerprint to recognize you?
The fb.zone catalog can detect that the extension is installed through a boolean page marker. No unique or persistent per-user identifier is created.
Sets documentElement.dataset.fbzoneExtension to 1 on catalog pages while deliberately not exposing the extension ID. — js/content/content.js:1027-1041
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
DOM reads are limited to layout roles, dimensions and computed presentation used by the theme engine. — js/content/content.js:89-129, 905-921
The only background fetch receives a validated theme-media URL and sends the returned bytes back to the tab. — js/background/init.js:102-145
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No input, keyboard, form, clipboard, canvas capture or screenshot data path exists. — js/content/content.js:1-1061
Can a website or remote server send commands that make the extension take actions?
The fb.zone page can ask the page access to install, apply, enable or delete themes, and its services supplies selected theme records. It cannot issue arbitrary extension commands or code.
The page bridge accepts only install, apply, toggle, delete and getState and fetches install payloads from the fixed API itself. — js/content/content.js:942-1009
Normalizes theme identifiers and stores or activates only structured theme records. — js/shared/storage-manager.js:115-210
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Install and toolbar actions open fixed success or theme-collection pages on fb.zone. — js/background/init.js:15-47
Facebook modifications are visual CSS theme rules. — js/content/content.js:220-429
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is declared. — manifest.json:13-37
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Host access and content-script matches cover fb.zone and facebook.com only; nativeMessaging is absent. — manifest.json:16-37
Contains a development localhost branch, but the packaged manifest provides no route for this script to execute there. — js/content/content.js:20-27
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Encodes streamed media chunks after validating the URL and limiting total bytes. — js/background/init.js:64-75, 119-141
Decodes chunks into a Blob URL assigned to a muted video element. — js/content/content.js:712-813
Can ordinary websites access privileged extension features through messaging or exposed files?
Scripts on fb.zone can use a same-page message bridge to manage themes and read stored theme state. The bridge is restricted to that catalog origin and a fixed allowlist and does not accept raw theme data from the page.
Checks source, origin, marker and action allowlist; install requests contain only an ID and retrieve the actual record from the fixed API. — js/content/content.js:942-1009
No externally_connectable or web-accessible resource exposes the extension to unrelated sites. — manifest.json:1-45
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Site checks and initialization are explicit and deterministic. — js/content/content.js:15-33, 1015-1060
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Sets an 80 MB media ceiling, streams chunks and aborts when the tab disconnects. — js/background/init.js:73-86, 119-145
Revokes stale object URLs and discards late media results after theme changes. — js/content/content.js:791-813
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Generated input-related rules set appearance tokens and do not touch fields, values, actions or submit handlers. — js/content/content.js:220-310