Is this Ome.tv extension safe?

The short version

If you read nothing else on this page, read these three.

It is on the Chrome Web Store

You add it with Add to Chrome on its store listing. It went through the store review, all of its code is inside the package, and it updates itself from there.

What keeps you safe is the boundary

It may run on 2 sites, ome.tv and our own, and it declares 3 permissions. Your browser enforces that list whatever the code does, and you can read it below.

Older warnings describe a version that is gone

Until October 2026 the extension was an obfuscated zip that downloaded its code and removed a security header on ome.tv. That is what scanners and AI assistants flagged. The store version does none of it.

Why ChatGPT or Claude may call it malware

People paste our code into an AI assistant and get told it is dangerous, often with a confident number attached. Almost always what they pasted is the console script or the old zip loader, not the store extension. Here is what the assistant is reacting to, because it is worth understanding rather than dismissing.

The console script is deliberately unreadable

The script you can paste into the browser console is obfuscated: names are scrambled and text is encoded. Hiding intent is the first thing a scanner looks for.

It is built for you on our server

The console script is generated per account and carries a token bound to you. The retired zip loader fetched the same kind of script, decrypted it and ran it.

Running fetched code is a classic signature

Downloading code, decrypting it and executing it is the closest thing to a universal malware signature there is. The store extension does not do this: everything it runs is in the package Google reviewed.

The old zip weakened a security header

It removed the Content-Security-Policy header on ome.tv. The store version has no permission that could do that.

Old answers outlive the version

Assistants and search summaries repeat what was true when they last read about us. If one tells you to turn on Developer mode and load a folder, it is describing the retired version.

All of it at once is the classic shape

Any one of these is unremarkable. Together they are the textbook description of a dropper, which is why the extension moved to a form that has none of them.

Ask it again with the facts

If you are going to ask an assistant about this, give it the real facts about the version you would install, and ask for an accurate reading rather than a dramatic one.

I am deciding whether to install a browser extension, and I want an
accurate reading rather than a dramatic one. Weigh all of the facts below.

WHAT IT IS
A Manifest V3 browser extension for the video-chat site ome.tv. It overlays the
connection details of the person I am matched with. It is published on the
Chrome Web Store as "OME.UNDFND: IP Locator & Auto Skip for Ome.tv". I add it
by clicking "Add to Chrome" on the store listing, and it updates through the
store. It shows up in my browser's extension list and I remove it from there.

WHAT ITS MANIFEST DECLARES (this is the enforced boundary)
  permissions:      storage, scripting, alarms
  host_permissions: https://ome.undfnd.eu/*
                    https://ome.tv/*

HOW IT IS BUILT
  - All of its JavaScript ships inside the store package. It does not download
    and run code, and it uses no eval. The code is minified, not obfuscated,
    and the source is not published.
  - It fetches an access token for my account from the vendor's server and
    sends the network address of each ome.tv connection there to look it up.
  - It shows a consent screen after install and sends nothing before I accept.
  - An older version, distributed as a zip until October 2026, was obfuscated,
    downloaded its code and removed ome.tv's Content-Security-Policy header.
    That version is retired and none of it applies to the store version.

THE FACTS THAT BOUND IT
  - The manifest has no nativeMessaging, no downloads, no tabs, no history, no
    cookies, no webRequest, no declarativeNetRequest and no <all_urls>.
  - The extension's job is reading the OTHER person's incoming video to show
    the overlay. There is no MediaRecorder and nothing is queued for upload.

WHAT I WANT FROM YOU
  1. Given those permissions, what can this extension reach, and what is it
     unable to reach even if its code were malicious?
  2. What is the realistic worst case if the vendor is dishonest or breached
     later, compared with trusting any other store extension that updates
     itself?
  3. Which of my concerns does the permission boundary settle, and which does
     it not touch at all?

Do not describe reach the permissions do not allow. "Rootkit" or "records your
webcam and files" would contradict the manifest above; if you use language
like that, explain how the permissions permit it or leave it out.

Why the console script is still obfuscated

The store extension is not obfuscated. The backup route, a script you paste into the browser console, still is, and that is a trade we made knowingly.

• It is built for one account

  Each console script is personal and holds a token bound to your account and your device. Plain code makes lifting that token out of a screenshot considerably easier.

• Ome.tv works to detect and break overlays

  Readable code makes that easier. It is an ongoing back and forth rather than a one-time thing.

• It resists developer tools

  The console script pauses in the debugger if you open developer tools on ome.tv. That is the same anti-tampering reason, and it is exactly the behaviour a scanner dislikes.

• You do not have to use it

  If you can install an extension, the store version is the route we recommend, and it has none of the above. The console script exists for computers where nothing may be installed.

The same worry, different answers

What separates a malicious extension from an honest one is who controls it and what it is allowed to reach.

What you can actually check yourself

The boundary the browser puts around the extension is the part that keeps you safe, and none of it needs our cooperation.

1. 1

   Read the permissions before you install

   When you click Add to Chrome, the browser shows what the extension can access and asks you to confirm. That prompt is the browser reading the manifest, and it is the browser, not us, that enforces it.

   Show more detail

   An extension physically cannot touch a site that is not in its list, no matter what its code says. You are trusting your browser here, not our word.

2. 2

   Look again after installing

   Open your extensions page and click Details on the extension. Site access and permissions are listed there, and they match the manifest printed below.

3. 3

   Restrict it further yourself, any time

   In the same details page, set site access to On specific sites. This is a browser control we cannot override.

4. 4

   Check it is gone when you remove it

   Click Remove on your extensions page. Nothing is installed outside your browser, nothing is left in Windows, and there is no background program.

The permission list in full, so you do not have to go and find it

This is the whole of manifest.json from the Chrome Web Store version, v2.0.23, printed rather than described. It is the complete list of what the extension is allowed to do. If what your browser shows differs from this, something is wrong and we want to hear about it.

{
  "manifest_version": 3,
  "name": "__MSG_extName__",
  "short_name": "__MSG_extShortName__",
  "version": "2.0.23",
  "description": "__MSG_extDescription__",
  "default_locale": "en",
  "homepage_url": "https://ome.undfnd.eu/",
  "minimum_chrome_version": "111",
  "permissions": [
    "storage",
    "scripting",
    "alarms"
  ],
  "host_permissions": [
    "https://ome.undfnd.eu/*",
    "https://ome.tv/*"
  ],
  "background": {
    "service_worker": "background.js"
  },
  "action": {
    "default_title": "__MSG_extShortName__",
    "default_popup": "popup.html",
    "default_icon": {
      "16": "icon-16.png",
      "48": "icon-48.png",
      "128": "icon-128.png"
    }
  },
  "commands": {
    "load-now": {
      "suggested_key": {
        "default": "Alt+Shift+L"
      },
      "description": "__MSG_cmdLoadNowStore__"
    },
    "sync-now": {
      "suggested_key": {
        "default": "Alt+Shift+S"
      },
      "description": "__MSG_cmdSyncNowStore__"
    }
  },
  "icons": {
    "16": "icon-16.png",
    "48": "icon-48.png",
    "128": "icon-128.png"
  },
  "content_scripts": [
    {
      "matches": [
        "https://ome.undfnd.eu/*"
      ],
      "js": [
        "content-dashboard.js"
      ],
      "run_at": "document_idle"
    },
    {
      "matches": [
        "https://ome.tv/*"
      ],
      "js": [
        "content-ometv.js"
      ],
      "run_at": "document_idle"
    },
    {
      "matches": [
        "https://ome.tv/*"
      ],
      "js": [
        "fp-shield.js"
      ],
      "run_at": "document_start",
      "world": "MAIN"
    }
  ],
  "web_accessible_resources": [
    {
      "resources": [
        "vendor/*",
        "vendor/tfjs-wasm/*",
        "vendor/mediapipe/*",
        "vendor/deepfake/*",
        "vendor/deepfake/ort-1.30.0/*"
      ],
      "matches": [
        "https://ome.tv/*"
      ]
    }
  ]
}

Things we will never ask you to do

Worth knowing because software that actually wants to harm you needs at least one of these, and asking is how it gets caught. If anything claiming to be us ever asks for one, it is not us.

Turn off your antivirus, or add an exclusion for us

Not in the install steps, not in a support ticket, not to fix an error. If a scanner objects to something, the answer is this page, not a folder your antivirus stops looking at.

Run an installer, or approve an administrator prompt

The extension installs from the Chrome Web Store into your browser. Nothing is installed into Windows, nothing asks for elevation, and there is no .exe to run.

Turn on Developer mode or load a folder

That was how the retired zip version was installed. The current extension comes from the Chrome Web Store only. A page or a person telling you to load our extension from a folder is out of date, or is not us.

Give us a password

Signing in goes through Discord and we never see your details. There is no password field anywhere on this site, so anything asking you for one is not us.

Send us a file, a screenshot of your screen, or remote access

Support is text. Nobody here will ask to connect to your computer or to have you run a command we sent you.

What leaves your computer, and what does not

The overlay analyses the video on the other side of your connection. That deserves a straight answer rather than a reassuring one, so here is the line, item by item.

About the video analysis specifically

Some features look at video. Here is exactly how far that goes, including the one that touches your own camera.

One frame at a time, then discarded

A single frame is grabbed from the incoming video, shrunk, inspected, and thrown away. Nothing is written to disk and nothing is queued for upload.

The analysis runs on your computer

Detecting a face, a blank camera or a looping recording all happen inside your browser. Your machine does the work, which is also why nothing needs to be sent.

The face features are off unless you turn them on

The detection library is only downloaded the first time you switch on a rule that needs it. If you never do, it is never fetched and never runs.

The recording check is plain arithmetic

Spotting a looped or frozen video compares patterns of light and dark between frames. There is no model, no face involved, and nothing that describes a person.

Your own camera, if you switch effects on

There is an optional feature that blurs or masks your face in the video you send out. Turning it on puts the overlay in the middle of your outgoing camera stream, which is worth knowing even though the purpose is to show people less of you rather than more.

That one is off until you enable it, and stays local

The masking is drawn on your machine and only the already-masked video is sent, to the person you are talking to and not to us. With the feature off, the overlay never touches your camera at all.

The security header the old version removed

This used to be the one thing on this page that genuinely lowered a defence. It stays here because answers about us still mention it.

What the header does

Websites can tell your browser which code it is allowed to run on their pages. It is a good protection, and it exists to stop injected scripts.

The zip version removed it on ome.tv

Until October 2026 the extension stripped that header on ome.tv so its overlay could load. That cost ome.tv one layer of protection while it was installed.

The store version does not

It has no declarativeNetRequest permission, so it cannot change any header on any site. You can confirm that in the manifest above.

Still on the zip version?

Open your extensions page, remove ome.undfnd loader, and add the extension from the Chrome Web Store. You sign in once and your settings come back.

How we decide these things

Not a promise, four decisions already in the code, so you can see the pattern rather than read a claim about it.

Third parties are removed, not added

The face library was pulled off a public host and now ships inside the extension, so users stop announcing themselves to a company we cannot audit. Every outside dependency gets that question asked of it.

Your access does not work for anybody else

Access is tied to your account and to the browser it was set up in, and it is re-proven on every request. Somebody who copies it gets a refusal, not your account.

It only runs where it is meant to

The overlay is injected into ome.tv and nowhere else. The browser enforces that through the host list, not our code.

Requests are signed and short-lived

Every call the overlay makes carries a signature that expires in seconds, so a captured request cannot be replayed later.

What we are not claiming

The limits of everything above, stated by us rather than found by you later.

Still not comfortable?

That is a legitimate place to land, and we would rather you stayed there than installed something you had doubts about. If you want a specific claim on this page checked, ask in a support ticket. The store listing shows the permissions before you install, and What it can reach lists them one by one.

If you find something on this page that is wrong, tell us and we will correct it here. A transparency page that quietly goes stale is worse than not having one.