Is the OME.UNDFND Ome.tv extension safe to install?

It declares 4 permissions and 3 host patterns, all listed in the manifest.json inside the download, and the browser enforces them regardless of what the code does. It can run on ome.tv and on our own site, and nowhere else. It cannot read your other tabs, your history, your bookmarks or your passwords. What it is allowed to reach does not depend on where it was downloaded from.

Why is it not in the Chrome Web Store?

Three things in the current build are against store policy: the loader fetches and runs code that is not in the package, the JavaScript is obfuscated, and one packaged rule removes a security header on ome.tv. Those are policy violations rather than judgement calls, so the product as it ships cannot be listed. We say this rather than implying a listing exists.

Will using it get my Ome.tv account banned?

We have never claimed it will and we know of no Ome.tv enforcement against overlay users on that basis. Bans discussed on this site are the fingerprint and IP bans that happen to people who have installed nothing at all.

Can the extension see my other tabs or my passwords?

No. It has no tabs permission, no history permission and no access to any site outside ome.tv and undfnd.eu. Those limits are declared in the manifest and enforced by the browser itself.

Is it a userscript or a Tampermonkey script?

No. No userscript manager is involved at any point. It is a Manifest V3 browser extension that you load as an unpacked folder on a desktop browser. The Greasyfork userscript with a similar name is a different project by different people.

Permission boundary

What This Ome.tv Extension Can Reach, and What It Cannot

Every permission it asks for, every site it can touch, and the things about it you would rather know before installing than find out afterwards. All of it is in the manifest.json inside your download, and none of that file is obfuscated.

The permissions it declares

Four, and the browser enforces every one of them whatever the code does.

storage
Keeps your settings, keybinds and session on your own machine so the overlay looks the same next time.
It is the browser's storage area for this extension only. It cannot read another extension's storage, your browsing history, your bookmarks or your saved passwords.
scripting
Injects the overlay into the Ome.tv page so the panel can draw over the video.
It can only inject into the sites listed under host access below. Chrome enforces that list, not us.
alarms
Wakes the background worker on a timer to refresh your session and check for a new build.
A scheduler and nothing else. It carries no data and reaches no page.
declarativeNetRequest
Applies one packaged rule that removes the Content-Security-Policy header on ome.tv, which is what allows the overlay to load at all on that page.
The rule ships in the download as rules.json and you can read it. It is scoped to ome.tv. This is a real reduction of one of that page's browser protections and we say so plainly in the concessions below rather than leaving you to find it.

Note what is absent. There is no tabs, no history, no cookies, no webRequest and no <all_urls>. An extension cannot use a permission it has not declared, and the list above is the whole declaration.

The sites it can touch

Three patterns. Two are ours. One is Ome.tv.

https://ome.undfnd.eu/*Our own site, so the dashboard can tell the extension it is signed in and hand it your settings.
https://*.undfnd.eu/*Our own subdomains, used for the API the overlay calls to resolve a connection.
https://ome.tv/*The only third-party site. This is where the overlay runs.

Where code is actually injected

content-dashboard.json https://ome.undfnd.eu/*
content-ometv.json https://ome.tv/*

This build

What you are installing, and on what.

Manifest version: Manifest V3, extension v1.6.0
Install method: Unpacked folder, loaded through your browser's own extensions page
Works on: Chrome, Edge, Brave, Opera, Vivaldi on desktop
Does not work on: Firefox, Safari, iOS, Android, any phone or tablet browser

What we cannot prove to you

The things a sceptical reader finds on their own. Better said here first.

The JavaScript in the download is obfuscated
You cannot read the extension's code the way you can read an open-source project's. It is obfuscated because the product is paid and the build is per-user, and an unobfuscated build is trivially resold. That is a commercial reason, not a security one, and it does mean you are trusting us on the parts the manifest does not cover. The manifest, the rules file and the permission list are not obfuscated, and those are the parts that decide what the extension is allowed to touch.
It is not reviewed by any extension store
There is no Chrome Web Store listing and no store review behind this. Anyone telling you an unlisted extension is inherently safe is guessing, and so is anyone telling you it is inherently dangerous. What is checkable is the permission boundary above, which the browser enforces whatever the code does and wherever it was downloaded from.
It removes a security header on Ome.tv
The packaged rule strips the Content-Security-Policy header from ome.tv so the overlay can load. That genuinely lowers one of the protections that page ships with, in your browser, on that site. It does not affect any other site, and it is visible in rules.json inside the download.
It only runs on desktop Chromium browsers
Chrome, Edge, Brave, Opera and Vivaldi on Windows, macOS and Linux. It does not work on Firefox, on Safari, or on any phone or tablet browser, and no version of it is coming to those. If someone offers you an Ome.tv locator for a phone, it is not this.

Questions people ask before installing

Is the OME.UNDFND Ome.tv extension safe to install?
It declares 4 permissions and 3 host patterns, all listed in the manifest.json inside the download, and the browser enforces them regardless of what the code does. It can run on ome.tv and on our own site, and nowhere else. It cannot read your other tabs, your history, your bookmarks or your passwords. What it is allowed to reach does not depend on where it was downloaded from.
Why is it not in the Chrome Web Store?
Three things in the current build are against store policy: the loader fetches and runs code that is not in the package, the JavaScript is obfuscated, and one packaged rule removes a security header on ome.tv. Those are policy violations rather than judgement calls, so the product as it ships cannot be listed. We say this rather than implying a listing exists.
Will using it get my Ome.tv account banned?
We have never claimed it will and we know of no Ome.tv enforcement against overlay users on that basis. Bans discussed on this site are the fingerprint and IP bans that happen to people who have installed nothing at all.
Can the extension see my other tabs or my passwords?
No. It has no tabs permission, no history permission and no access to any site outside ome.tv and undfnd.eu. Those limits are declared in the manifest and enforced by the browser itself.
Is it a userscript or a Tampermonkey script?
No. No userscript manager is involved at any point. It is a Manifest V3 browser extension that you load as an unpacked folder on a desktop browser. The Greasyfork userscript with a similar name is a different project by different people.

Who runs this

OME.UNDFND has run continuously since 2022. Written contact is [email protected], which reaches us without joining a chat platform first, and the Discord server is the fast route. Our privacy policy and terms set out what is stored and under which law.

For how the safety question looks in practice rather than in a permission table, read is the Ome.tv locator safe, and for how it compares with the alternatives, the best Ome.tv IP locators.