Is Saner Social Media (SSM) safe?
We analyzed Saner Social Media (SSM) version 1.14.2's actual code and gave it a 86/100 trust score. This appears to be a purpose-aligned feed-blocking…
Bottom line
This appears to be a purpose-aligned feed-blocking extension with broad page access but no established abuse.
What it can access
It can inspect and change pages across 11 platforms in every frame, which fits feed blocking but is broad access.[Q1]
Security weaknesses
No meaningful weakness was found that lets websites or remote services control the extension or gain extra privileges.[Q16][Q21]
Signs of misuse
No evidence shows tracking, sensitive-data collection, outside communication, or deceptive changes to links and traffic.[Q6][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
Its page access runs at document start in all frames across 11 supported social platforms, but it requests only Chrome sync storage beyond that page access.
Lists YouTube, X, Instagram, Facebook, TikTok, Pinterest, LinkedIn, Twitch, Reddit, GitHub, and Hacker News matches with all_frames, plus storage. — manifest.json:17-51,63-65
Which websites can it run on, and can it read or change what appears on those pages?
It inspects known feed and recommendation elements to hide them; no extraction of posts, messages, profiles, or account content was found.
Queries site-specific selectors, injects CSS, removes its own injected elements, and inserts local quote widgets. — content.js:8721-8744,8784-8851,8890-9562
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Page reads are limited to paths, selector presence, computed background colors, and media elements selected for blocking. — content.js:8698-8851,8890-9562
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads its own synced blocking settings and snooze timestamp, but no browser history, bookmarks, passwords, cookies, or autofill data.
Reads snoozedUntilTimestamp and userConfig from chrome.storage.sync. — content.js:14-20,9583-9598
Requests only storage. — manifest.json:63-65
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant permissions. — manifest.json:63-65
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains no fetch, XMLHttpRequest, WebSocket, sendBeacon, or extension-message transmission. — content.js:1-9600
Only manages the options page, snooze storage, and action badge. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Behavior is selected only by packaged site actions and locally synced userConfig values. — content.js:8784-8812,9583-9598
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically checks supported pages and applies enabled blocking rules, which is the advertised feature and can be snoozed.
Runs at load, route changes, storage changes, and a one-second interval, then skips actions while snoozed or disabled. — content.js:8784-8793,9583-9598
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings or network-control permissions. — manifest.json:53-65
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses readable functions, classes, source-region labels, and descriptive identifiers. — content.js:1-21,8697-8857,9581-9600
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All behavior is packaged and uses direct functions. — content.js:1-9600
Declares no remotely hosted script or permissive extension CSP. — manifest.json:53-65
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads window.location pathname and href locally during route checks. — content.js:8698-8719,9583-9598
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains local blocking logic and packaged assets without telemetry calls. — content.js:1-9600
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies, identity, or webRequest permission. — manifest.json:63-65
Reads only URL paths, DOM layout information, and its own storage settings. — content.js:8698-8851,9583-9598
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
DOM operations target feed containers, media, styles, and extension-created quote elements rather than user input. — content.js:8721-8851,8890-9562
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Only packaged actions enabled by local settings can run. — content.js:8784-8812,9583-9598
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Applies packaged CSS, pauses selected video/audio, and creates text-only replacement widgets. — content.js:8768-8772,8784-8851,8890-9562
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads, or proxy capability. — manifest.json:53-65
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares only a packaged worker, popup/options pages, and storage. — manifest.json:53-65
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Site rules and quotes are packaged locally and no network-fetch path exists. — content.js:1-9600
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no runtime message listener, window message listener, or DOM-event command tunnel. — content.js:1-9600
Declares no externally_connectable entry. — manifest.json:1-76
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Requires a true local userConfig flag and a non-active snooze state before changing a page. — content.js:14-20,8784-8812,9583-9598
Updates the badge from the stored snooze time and clears it when snooze ends. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Recurring work only rechecks the current supported page and local configuration. — content.js:9583-9598
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Changes feed containers and adds extension-owned quote elements; it does not target forms or inputs. — content.js:8721-8851,8890-9562