Are Twitch extensions safe? JeetBot's OAuth token leak and the open-source picks reviewed

Your Twitch session token is the key to your account. Chat, whispers, channel points, account settings — anything Twitch's own web client can do as you, one string stands in for all of it. In September, Socket researchers found that a Twitch extension with about 31,000 users across Chrome and Firefox had been sending that key to its operator's servers, tucked into a URL.

The extension is Twitch Enhanced Viewer | JeetBot, run by JeetBot, a commercial Russian-language bot service for Twitch, Kick and VK Live. Socket's write-up classifies it as malicious. The developer disputes that, says the token handling served playback, and has shipped a version that stops sending the token.

Both listings are still up, and in early November the Extenshi catalog shows them on the Firefox fix and a newer Chrome build; the Chrome listing is down to about 20,000 users. But Firefox got the fix first, and Chrome users were still on the forwarding build on the day the developer announced it. BleepingComputer covered the story on September 14, 2026.

Here's what the extension did, what to do if you had it installed, and which Twitch extensions I'd pick instead.

Quick verdict

• JeetBot forwarded your Twitch session token. Per Socket, it read the Authorization header Twitch's web client uses and appended your token as an auth= parameter to the video-playlist requests it redirected through its operator's proxy. The token landed in cleartext in that proxy's request logs.
• The disclosures said the opposite. The Chrome Web Store privacy section said the developer "will not collect or use your data," and earlier builds, per Socket, posted captured tokens straight to a collection endpoint.
• The fix reached Chrome last. Version 85.8.7 stopped the forwarding on Firefox by September 16. Socket confirmed Chrome's fixed build, 85.8.9, on September 25.
• If you had it installed: update or remove it, then sign out of all your Twitch sessions and sign back in. Uninstalling does not invalidate a token that already left your browser.
• For emotes and chat, open source wins: BetterTTV, FrankerFaceZ and 7TV publish their code, don't route your video through their own servers, and don't need you to connect your Twitch account for the basics.

What JeetBot sold, and what that design requires

Twitch's player and chat are functional but spartan, so a whole category of extensions grew around them: extra emotes, chat filtering, player tweaks. JeetBot's listing promised something else: Twitch ad blocking, forced 1080p, region-unlocked streams and automatic channel-point collection.

That promise has a cost that's easy to miss. To deliver it, the extension redirected Twitch's video-playlist requests (to usher.ttvnw.net) through the operator's proxy servers. Whoever runs that proxy sees every stream you open — and in this case, your account token rode along on the same request.

It's a different failure mode from the one in my review of streaming enhancement extensions that sell viewing data. That network monetized what you watched. JeetBot routed a working credential through its operator's infrastructure. Neither was explained to the people installing them.

The leak: an account key riding in a URL

The mechanism, as Socket documented it in the code: a content script captured the Authorization header from Twitch's own web client and passed it to the extension's background worker. When the worker redirected a playlist request to the proxy, it appended the token to the URL as &auth=.

What kind of token it was matters. Socket showed it was the account-scoped OAuth token, not the narrow token Twitch issues for video playback — the extension even validated it against Twitch's own token endpoint. A bearer token like that lets whoever holds it read and send whispers, post in chat and spend channel points, with no password and no second factor.

And playback didn't need it. Per Socket, the stream token already sits in the playlist URL, and the extension's own code sent some channels through a proxy with no account token at all: a list of ten Russian-language streamer channels. Socket calls that list hard-coded; the developer told BleepingComputer it was "a user-editable playback setting for addressing a specific Twitch proxy/VPN error."

URLs are the most heavily logged thing on the web: server request logs, every proxy and load balancer in front of them, browser history, Referer headers. That's why the bearer-token spec, RFC 6750, says a token SHOULD NOT go in a URI query parameter unless neither the Authorization header nor the request body can carry it. Headers don't end up in access logs by default; URLs do.

What the store pages said

According to Socket, the Chrome Web Store privacy section said the developer "will not collect or use your data," and the linked privacy policy said the extension "does not collect, store, or process any user data." Neither mentioned the token.

The older builds are the part that's hard to read charitably. Socket found that version 4.8, from January 2026, POSTed captured tokens to a dedicated set-token endpoint on JeetBot's servers, with two Deno-hosted backups. It also remembered the last token it sent and waited five seconds between sends, which Socket reads as a server keeping them. The inline auth= forwarding arrived in May, after the version number jumped from 7.2.6 to 85.2.2.

The developer's statement to BleepingComputer conceded that "our privacy disclosures did not explain this clearly enough" and rejected the malicious label: "the implementation served playback functionality, and the published report does not demonstrate unauthorized use of the tokens." On that last point, nothing published so far shows the forwarded tokens being misused. Twitch Support said on X that it was aware of reports of "a third-party browser extension potentially impacting account security," as Infosecurity Magazine reported.

Fixed on Firefox first, Chrome later

Socket published on September 11. By September 16, Firefox version 85.8.7 no longer forwarded the token — Socket checked the code — while the Chrome build, 85.8.4, still did. In the developer's words that day, the fix "is available on Firefox and is awaiting Chrome Web Store review."

Socket confirmed the fixed Chrome build, 85.8.9, on September 25. For some part of those nine days, a Chrome user who installed from the store, or whose copy hadn't updated yet, ran the forwarding build after a fix already existed.

The Chrome Web Store queue has been a story of its own this year. In April and May, developers in a PSA thread on the chromium-extensions group reported waiting 28 to 30 days for updates, bug fixes included — I wrote about what that backlog costs developers in what it really takes to publish a browser extension. JeetBot's wait was shorter, but it was the same queue deciding when a security fix reached Chrome users.

The practical takeaway: after any extension security story, "installed from the store" does not mean "running the fixed version." Check the version number on chrome://extensions, and if it's still the old one, disable the extension until the update arrives.

If you had JeetBot installed: update, then sign out everywhere

In this order:

1. Update or remove. If you keep it, make sure you're on 85.8.7 or newer on Firefox and 85.8.9 or newer on Chrome. If you don't need it, remove it.
2. Sign out of all your Twitch sessions, then sign back in. That's Socket's recommendation, and it's the step that counts. The token came from your own logged-in Twitch web session, not from an app you authorized, so there's no app connection to revoke — ending the sessions is what invalidates it.
3. Remember that uninstalling is not revoking. The extension leaving your browser does not pull the token back from wherever it already went. It's the same trap I described in my OAuth audit piece after the Vercel breach: "uninstalled" doesn't mean "disconnected."

The alternatives: open source, no proxy, no account needed

The three best-known community Twitch extensions do the core job — emotes and chat quality of life — without sending your video anywhere:

• BetterTTV — the veteran: BTTV global and channel emotes plus chat features. Works without signing in to BTTV.
• FrankerFaceZ — emotes plus deep chat and UI customization, extended through add-ons. No account needed for the basics.
• 7TV — the emote-first option, with an optional account for extras like personal emote sets.

The architectural difference is the point. These tools work at the page level: they add emotes and UI to the Twitch you're already watching, and the player keeps talking to Twitch directly. None of them promises what JeetBot did — ad-free, region-unlocked playback — and that's no coincidence. That feature is a proxy, so any tool offering it sends your playlist requests through someone's servers; the question is what rides along.

Open source doesn't make an extension bulletproof — a malicious update can change anything, which is the subject of my piece on malware that arrives in the update. What public code gives you is auditability: when someone says "we don't touch your token," anyone can read the network calls.

The three don't look identical in the catalog either: FrankerFaceZ's report flags more code-hardening issues than BetterTTV's or 7TV's, so read them before you pick. If you're coming at this from the YouTube side, my SponsorBlock / Return YouTube Dislike / Enhancer for YouTube review runs the same playbook on that ecosystem.

How to check Twitch extensions before you install

• Ask whether it needs your login at all. An emote tool doesn't. Anything that asks to connect your Twitch account should have to earn it with a feature you can name.
• Ask where the video goes. Socket's advice is to treat any extension that proxies a logged-in service's traffic as having access to that service's session. If a tool proxies playback, choose that design consciously.
• Pull the report. Search the catalog for Twitch extensions — each page lists the permissions from the published package — or check an extension → with its store URL for that single extension's safety report.
• Know what a report can't see. A catalog report describes the package that's live now. JeetBot's report covers a build scanned after the fix, not the version you may have run in September, and no package scan sees what an operator's server does with the requests it receives. The questions above cover that gap.

Final recommendation

• Had JeetBot installed: update to the fixed version or remove it, then sign out of all Twitch sessions and sign back in. Assume the old token was logged.
• Emotes and chat: BetterTTV, FrankerFaceZ or 7TV — read their reports, then pick by feel.
• Any playback-proxying "enhancer": assume the operator's servers see your streams and possibly your session. Connect your account only when a feature genuinely needs it.
• After any extension security news: check your installed version, not the store page. Review queues decide when fixes reach you.

Check an extension →

Scan the extensions you installed from a store with Guard →

Sources

• Socket Threat Research — "Twitch Browser Extension Exposes 30,000 Users' OAuth Tokens to Russian Bot Service" (September 11, 2026; updated September 16 and September 25, 2026): https://socket.dev/blog/malicious-twitch-browser-extension
• BleepingComputer — "Twitch extension with 30K installs exposes users' OAuth tokens" (September 14, 2026; updated September 16, 2026 with the developer's statement): https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/
• Infosecurity Magazine — "Malicious Twitch Extension Exposes 31,000 Users' OAuth Tokens" (September 14, 2026), for Twitch Support's statement: https://www.infosecurity-magazine.com/news/malicious-twitch-extension-oauth/
• Chromium Extensions Group — "PSA: Increase in review times for submissions to the Chrome Web Store": https://groups.google.com/a/chromium.org/g/chromium-extensions/c/VJ6DcpEn51Y/m/yuxvHWdwCAAJ
• IETF RFC 6750 — The OAuth 2.0 Authorization Framework: Bearer Token Usage (URI query parameter restrictions): https://www.rfc-editor.org/rfc/rfc6750
• BetterTTV, FrankerFaceZ and 7TV — open-source repositories on GitHub, linked in "The alternatives" section above

---

This article is based on publicly available security research, store listings, developer statements and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].