What our analysis found

Stylish - Custom themes for any website, used by 2,000,000 people, is rated malicious by Extension Auditor. Our code review reported 5 findings (4 critical, 1 high), led by network interception. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests.

Key findings

• critical· network interception —The extension overwrites XMLHttpRequest.open and.send to intercept all XHR traffic, capturing request URLs, response text, and uploaded file data. It then dispatches custom events ('antifork') to feed intercepted data to its rule engine. This is far outside the scope of a CSS-theming extension and constitutes unauthorized network monitoring.
• critical· network interception —The extension intercepts all fetch traffic, cloning and reading response bodies, even when they contain binary streams. It captures request and response data, including file uploads, and dispatches them. This is unnecessary for a theme app and clearly designed for data harvesting.
• critical· network interception —The extension overwrites the WebSocket constructor to intercept all WebSocket messages, forwarding them to its internal system. This further expands its surveillance capability beyond the extension's advertised function.
• critical· unauthorized data collection —This function, part of the 'EqualsSign' module, sends extracted data (scraps) to the background service worker via chrome.runtime.sendMessage. The data includes DOM-scraped content and intercepted network payloads, as processed by the dynamic rule engine. This is the exfiltration point for collected information.
• high· obfuscation —The 'EmitStop' module decodes obfuscated rule configurations from chrome.storage.local (BufferEquals) using a transposition cipher and base64. This obfuscation hides the true nature of the data collection rules and indicates an intent to conceal functionality from reviewers.

The extension contains extensive, unauthorized data-collection functionality that is unrelated to its stated purpose of applying custom CSS themes. It monkey-patches XMLHttpRequest, fetch, and WebSocket to intercept all network traffic, extracts DOM content via a dynamic rule engine, and exfiltrates data via chrome.runtime.sendMessage. The rules are obfuscated and remotely updatable, a hallmark of spyware. The privacy disclosure mentions only 'Web history', which does not cover the granular page content, ad details, and request payloads collected. The publisher historically engaged in similar tracking with a previous version of Stylish.