Stream Cleaner
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Blocks Twitch.tv ads, allowing you to focus on your favorite streams without interruptions. Lets you enjoy a more seamless viewing experience, ideal for frequent Twitch users and streamers alike. Adds a layer of convenience to your browsing habits, benefiting those who spend significant time on the platform.
Overview
This Twitch™ adblock extension blocks all the ads on twitch.tv.
Adblocker for Twitch™ works very well and blocks the pre and mid-roll ads while watching live streams or videos.
How To Use:
> Click on the "Add to Chrome" button to install it.
> After Installation, click on "Extension icon".
> Then you will see a pop-up to enable/disable the Adblocker.
Version 1.3.0 changes
>> Twitch "commercial break in progress or purple screen" bug fixed
Important: This extension does not share/collect any of your personal information and it is developed on the basis of an open-source code.
Tags
Privacy Practices
Security Analysis — Stream Cleaner
Permissions
Code Patterns Detected
External Connections
Package Contents 68 files · 124KB
What This Extension Does
The Stream Cleaner extension helps block Twitch.tv ads, making it easier for users to watch streams without interruptions. It's designed for Twitch streamers and viewers who want a seamless viewing experience. With over 400,000 users, this extension is a popular choice among the Twitch community.
Permissions Explained
- declarativeNetRequestexpected: This permission allows the extension to block or modify network requests, which in this case is used to block ads on Twitch.tv.
Technical: This permission grants access to the declarativeNetRequest API, allowing the extension to intercept and manipulate HTTP requests. This can be a high-risk permission if not properly implemented, as it could potentially be used for malicious purposes such as injecting malware or stealing sensitive data. - storageexpected: This permission allows the extension to store and retrieve data locally on your device.
Technical: This permission grants access to the storage API, allowing the extension to read and write data to local storage. This can be a medium-risk permission if not properly implemented, as it could potentially be used for malicious purposes such as storing sensitive data or tracking user behavior. - unlimitedStorageexpected: This permission allows the extension to store an unlimited amount of data locally on your device.
Technical: This permission grants access to the unlimited storage API, allowing the extension to store a large amount of data without any limitations. This can be a medium-risk permission if not properly implemented, as it could potentially be used for malicious purposes such as storing sensitive data or tracking user behavior. - tabsexpected: This permission allows the extension to access and interact with tabs in your browser.
Technical: This permission grants access to the tabs API, allowing the extension to read and write data to tabs. This can be a medium-risk permission if not properly implemented, as it could potentially be used for malicious purposes such as injecting malware or stealing sensitive data. - *://*.twitch.tv/*expected: This permission allows the extension to access and interact with Twitch.tv content.
Technical: This permission grants access to a specific domain, allowing the extension to read and write data to that domain. This can be a high-risk permission if not properly implemented, as it could potentially be used for malicious purposes such as injecting malware or stealing sensitive data.
Your Data
The extension accesses and stores data locally on your device, but does not collect any personal information. It sends requests to various domains, including Twitch.tv, assets.twitch.tv, and api.ttv.lol.
Technical Details
Code Findings
This extension loads external scripts in its service worker, which can potentially be used for malicious purposes such as injecting malware or stealing sensitive data.
Technical: The extension uses the importScripts method to load external scripts from the following URLs: https://assets.twitch.tv/... and https://www.blocktwitchads.com/...
💡 This pattern is commonly used in legitimate extensions to load necessary scripts for functionality.
The extension uses innerHTML assignment, which can potentially be used as a cross-site scripting (XSS) attack vector if not properly sanitized.
Technical: The extension assigns innerHTML to an element using the innerHTML property in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to dynamically update content.
The extension makes XHR requests to various domains, which can potentially be used for malicious purposes such as injecting malware or stealing sensitive data.
Technical: The extension uses the XMLHttpRequest object to make requests to the following domains: assets.twitch.tv, www.blocktwitchads.com, pxy.blocktwitchads.com, api.ttv.lol, ttv.lol, usher.ttvnw.net, gql.twitch.tv
💡 This pattern is commonly used in legitimate extensions to fetch necessary data.
The extension creates script elements dynamically, which can potentially be used for malicious purposes such as injecting malware or stealing sensitive data.
Technical: The extension uses the document.createElement method to create script elements in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to load necessary scripts dynamically.
The extension reads data from browser storage, which can potentially be used for malicious purposes such as storing sensitive data or tracking user behavior.
Technical: The extension uses the chrome.storage API to read data in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to store and retrieve necessary data.
The extension writes data to browser storage, which can potentially be used for malicious purposes such as storing sensitive data or tracking user behavior.
Technical: The extension uses the chrome.storage API to write data in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to store and retrieve necessary data.
The extension monitors form inputs, which can potentially be used for malicious purposes such as tracking user behavior or stealing sensitive data.
Technical: The extension uses the document.addEventListener method to monitor form inputs in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to dynamically update content based on user input.
The extension can block or modify network requests, which can potentially be used for malicious purposes such as injecting malware or stealing sensitive data.
Technical: The extension uses the declarativeNetRequest API to block or modify network requests in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to block ads or other unwanted content.
The extension monitors storage changes, which can potentially be used for malicious purposes such as tracking user behavior or stealing sensitive data.
Technical: The extension uses the chrome.storage.onChanged event to monitor storage changes in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to dynamically update content based on storage changes.
The extension contains a potential hardcoded secret, which can potentially be used for malicious purposes such as injecting malware or stealing sensitive data.
Technical: The extension uses a hardcoded secret in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to store and retrieve necessary secrets.
The extension uses postMessage for cross-origin communications, which can potentially be used for malicious purposes such as injecting malware or stealing sensitive data.
Technical: The extension uses the window.postMessage method to send messages across origins in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to communicate with other scripts or services.
The extension sets up event listeners, which can potentially be used for malicious purposes such as tracking user behavior or stealing sensitive data.
Technical: The extension uses the document.addEventListener method to set up event listeners in the following file: /contentScript.js
💡 This pattern is commonly used in legitimate extensions to dynamically update content based on user interactions.
The Stream Cleaner extension has some security concerns, including potential XSS vectors and hardcoded secrets. However, it also uses some common patterns found in legitimate extensions. We recommend users exercise caution when installing this extension and regularly review its permissions and behavior.
