Security & Privacy
JS Injector is designed with security and privacy as core principles.
Privacy Policy
Last updated: July 2026
Single Purpose
This extension allows users to inject custom JavaScript and CSS into web pages to customize and automate their browsing experience.
JS Injector does not collect, transmit, or sell any personal data. All user data (scripts, settings, preferences) is stored locally in the browser using the chrome.storage.local / browser.storage.local API.
What We Don't Do
- We do not collect browsing history
- We do not track user behavior
- We do not send data to external servers
- We do not use analytics or telemetry
- We do not display advertisements
- We do not monetize user data in any way
- We do not transfer data to third parties
- We do not use data for advertising
What We Store Locally
- Scripts — your JavaScript and CSS code
- Settings — editor preferences, theme, language
- GM API data — key-value pairs stored by user scripts via GM_setValue
All of this data stays on your device and is never transmitted anywhere.
Data Collection
JS Injector collects zero data. There are no servers, no analytics, no phone-home calls.
The only network requests made by the extension are:
- User-initiated — when you import a script from a URL
- GM_xmlhttpRequest — when a user script makes an HTTP request (proxied through the extension to bypass CORS)
Both of these are explicitly triggered by the user, not by the extension itself.
Permissions Explained
Each permission the extension requests has a specific, documented purpose:
| Permission | Purpose | Scope |
|---|---|---|
storage | Store scripts and settings | Local only |
activeTab | Inject into current tab on demand | Active tab only |
scripting | Execute scripts via executeScript API | When triggered |
contextMenus | Right-click menu items | Extension menu only |
webNavigation | Detect page loads for auto-injection | URL matching only |
sidePanel | Open the side panel editor | On user action |
<all_urls> | Match patterns for script injection | Per-script patterns |
The <all_urls> host permission is required for the extension to inject scripts into any website. However, scripts only run on URLs that match their specific patterns — not on all sites.
Script Security
JS Injector executes user-provided JavaScript code. This is the core functionality of the extension. Users should be aware of the following:
Imported Scripts
When importing scripts from external sources (JSON files, URLs, .user.js files), you are executing code written by others. Always review the code before importing.
GM API Access
Scripts with @grant permissions can access the GM API, which provides:
- Persistent storage (GM_setValue/GM_getValue)
- Cross-origin HTTP requests (GM_xmlhttpRequest)
- Clipboard access (GM_setClipboard)
- Desktop notifications (GM_notification)
Only grant permissions that your scripts actually need.
Best Practices
- Review code before importing scripts from others
- Use specific match patterns instead of
*://*/* - Only grant GM API permissions you actually need
- Keep scripts minimal and focused
- Regularly audit your installed scripts
Remote Code Policy
JS Injector does not load, fetch, or execute any remotely hosted code. All extension code is bundled within the extension package and reviewed by browser stores before publication.
User scripts are stored locally using chrome.storage.local and executed via chrome.scripting.executeScript(). The extension does not use eval() on remote content and does not include any analytics, tracking, or telemetry code.
The only network requests made by the extension are:
- User-initiated imports — when the user explicitly provides a URL to import a script
- GM_xmlhttpRequest — when a user script makes an HTTP request (proxied through the extension to bypass CORS, only when explicitly triggered by a user script)
Content Security Policy
JS Injector uses the scripting.executeScript API with world: 'MAIN' to inject scripts. This bypasses the page's Content Security Policy (CSP) because the injection happens at the browser extension level, not through inline script tags.
The extension's own CSP is:
script-src 'self'; object-src 'self'This means the extension can only execute scripts that are part of its own package. No remote code execution is possible within the extension itself.
Open Source
JS Injector is open-source. The full source code is available for review, audit, and contribution.
Anyone can inspect the code to verify that:
- No data is collected or transmitted
- No tracking or analytics are present
- No remote code is loaded
- Permissions are used only as documented
Report a Vulnerability
If you discover a security vulnerability in JS Injector, please report it responsibly:
- Email: security@js-injector.dev
- GitHub: Open a private security advisory
We take security seriously and will respond to reports within 48 hours.