Tampermonkey
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Blocks annoying ads and trackers with Tampermonkey, a powerful userscript that lets you change the web at will. Ideal for web developers, researchers, and anyone tired of intrusive online content, this extension brings flexibility and control to your browsing experience. Most benefiting from its capabilities are those who spend hours online, such as students, professionals, and enthusiasts.
Overview
Enhance your browsing experience with Tampermonkey! 🌐🚀
Tampermonkey is a versatile browser extension with over 🔟 million users that enhances your browsing experience by allowing you to run userscripts on websites.
Userscripts are small programs that modify page layouts, add or remove features, and automate actions to personalize your web experience.
### 🔑 Key Features: ###
🛠️ Efficiently manage and edit your userscripts
⚡ Swiftly activate and deactivate scripts with just two clicks
🔗 Synchronize scripts using Chrome Sync and various cloud storage services (Google Drive, Dropbox, OneDrive, Yandex.Disk, and WebDAV)
💾 Backup and restore options and userscripts through zip files and/or cloud storage
🔄 Automatic script updates for a seamless experience
For a comprehensive overview, check out our frequently asked questions or simply install the extension. 💡
### 🔍 Discover Userscripts: ###
Find a wide array of userscripts at www.userscript.zone. 🌟
### 📌 Useful Links: ###
🐛 Bug Reports: http://tmnk.net/bug
📝 Full Changelog: http://tmnk.net/changelog.php?ext=dhdg
❓ Frequently Asked Questions: http://tmnk.net/faq
🔎 Userscript Search: https://www.userscript.zone
### 🔐 Data Usage & Privacy: ###
Tampermonkey collects anonymous usage information to improve your experience, such as:
📦 Extension version
🌍 Preferred language
🚫 Script installations for blacklist updates
🖥️ Browser and operating system type
Additionally, error reports containing anonymous information are automatically sent when internal errors occur.
You can disable this feature by adjusting the "Anonymous statistics" setting in the extension. ⚙️
Note: In incognito mode, no usage information is collected or sent. 🕵️♂️
For specific functions (e.g., blacklist updates), data from the browser's user-agent string may be collected.
You can disable this by adjusting the "Userscript Blacklist Source" and "Show update notification" settings.
### 📍 Location Data: ###
If either the "Userscript Blacklist Source" or "Show update notification" setting is enabled, Tampermonkey sends HTTP requests, which inherently include your IP address.
Server logs only contain truncated IP addresses. If "Anonymous statistics" is enabled, your IP address helps determine your approximate region or country. 🌏
Thank you for using Tampermonkey! 😃
Tags
Privacy Practices
Security Analysis — Tampermonkey
Permissions
Code Patterns Detected
External Connections
Package Contents 84 files · 4.8MB
What This Extension Does
Tampermonkey is a browser extension that allows users to run custom scripts on websites, enhancing their browsing experience. It's suitable for power users who want to automate tasks and personalize their web experience.
Permissions Explained
- <all_urls>check this: Allows the extension to access all URLs visited by the user, including sensitive information like login credentials.
Technical: Accesses all URLs via Chrome's <all_urls> permission, allowing for potential data exfiltration or unauthorized script execution. ⚠ 1 - webRequestcheck this: Allows the extension to intercept and modify HTTP requests made by the user.
Technical: Accesses web requests via Chrome's webRequest API, enabling potential man-in-the-middle attacks or unauthorized data modification. ⚠ 1 - webRequestBlockingcheck this: Allows the extension to block HTTP requests made by the user.
Technical: Accesses web request blocking via Chrome's webRequestBlocking API, enabling potential denial-of-service attacks or unauthorized data suppression. ⚠ 1 - cookiescheck this: Allows the extension to read and write cookies on behalf of the user.
Technical: Accesses cookies via Chrome's cookies API, enabling potential session hijacking or unauthorized data access. ⚠ 1 - notificationscheck this: Allows the extension to display notifications to the user.
Technical: Accesses notifications via Chrome's notifications API, enabling potential phishing attacks or unauthorized data disclosure. ⚠ 1 - unlimitedStoragecheck this: Allows the extension to store an unlimited amount of data on behalf of the user.
Technical: Accesses storage via Chrome's unlimitedStorage API, enabling potential data exfiltration or unauthorized data storage. ⚠ 1 - tabscheck this: Allows the extension to access and manipulate tabs opened by the user.
Technical: Accesses tabs via Chrome's tabs API, enabling potential tab hijacking or unauthorized data access. ⚠ 1 - storagecheck this: Allows the extension to store and retrieve data on behalf of the user.
Technical: Accesses storage via Chrome's storage API, enabling potential data exfiltration or unauthorized data storage. ⚠ 1 - scriptingcheck this: Allows the extension to execute scripts on behalf of the user.
Technical: Accesses scripting via Chrome's scripting API, enabling potential code injection or unauthorized data access. ⚠ 1 - downloadscheck this: Allows the extension to download files on behalf of the user.
Technical: Accesses downloads via Chrome's downloads API, enabling potential file exfiltration or unauthorized data access. ⚠ 1
Your Data
Tampermonkey collects anonymous usage information, including extension version, preferred language, script installations for blacklist updates, and browser/operating system type. It also sends error reports containing anonymous information when internal errors occur.
Technical Details
Code Findings
This behavior allows the extension to load external scripts, which could potentially introduce malicious code or unauthorized data access.
Technical: The extension uses a service worker to load external scripts via the fetch API. This enables potential code injection or unauthorized data access.
💡 Loading external scripts is necessary for the extension's functionality, as it allows users to run custom scripts on websites.
This behavior could potentially allow an attacker to inject malicious code into the extension's UI, leading to unauthorized data access or other security issues.
Technical: The extension uses innerHTML assignment in its content script, which enables potential cross-site scripting (XSS) attacks.
💡 innerHTML assignment is commonly used for dynamic UI updates in legitimate extensions.
This behavior suggests that the extension may be attempting to obfuscate its code, which could make it more difficult for security researchers or users to understand its functionality.
Technical: The extension uses String.fromCharCode to encode strings in its JavaScript files. This is a common technique used for code obfuscation.
💡 Code obfuscation can be used to protect intellectual property or prevent unauthorized access to sensitive information.
This behavior is normal for extensions that need to communicate with external services, such as APIs or servers.
Technical: The extension makes XMLHttpRequests (XHR) to various domains, including those listed in the data exposure section. This enables communication with external services and APIs.
💡 Making XHR requests is necessary for extensions that need to interact with external services or APIs.
This behavior could potentially allow an attacker to inject malicious code into the extension's UI, leading to unauthorized data access or other security issues.
Technical: The extension creates script elements dynamically in its content script, which enables potential cross-site scripting (XSS) attacks.
💡 Creating script elements dynamically is necessary for some extensions that need to inject custom scripts into web pages.
This behavior allows the extension to communicate with other scripts or services across different origins, which could potentially introduce security risks if not properly implemented.
Technical: The extension uses postMessage to send data between its content script and other scripts or services. This enables cross-origin communication, but also introduces potential security risks if not properly implemented.
💡 Using postMessage for cross-origin comms is necessary for some extensions that need to interact with external services or APIs.
This behavior is normal for extensions that need to respond to user interactions or other events.
Technical: The extension sets up event listeners in its content script, which enables it to respond to user interactions and other events.
💡 Setting up event listeners is necessary for extensions that need to interact with web pages or respond to user input.
Tampermonkey has several security concerns, including excessive permission requests, potential data exfiltration, and unauthorized script execution. While it's a powerful tool for power users, we recommend exercising caution when installing and using this extension.
