Injected JS security — what a snippet can really do
Injected JavaScript is powerful — it runs with the full rights of the page you visit. That makes it useful and, at the same time, worth understanding. This article explains what a snippet can really do and whom to trust.
What injected JS can do
Rule code runs in the page context — it has the same access the page's own scripts do:
- Reads and changes the whole DOM — including form fields and their values.
- Reads cookies available to JS and the page's
localStorage. - Sends
fetchrequests on the page's behalf (within its CSP).
These are exactly the capabilities that make rules useful. But it means that running someone else's snippet runs someone else's code with those rights.
What injected JS cannot do
- It does not read pages on other domains — the page's same-origin policy applies to it.
- It does not reach files on your disk or other tabs.
- It does not read cookies marked
HttpOnly— those are invisible to JavaScript.
The trust principle — read before you paste
When importing a shared bundle, JustZix shows a warning if it contains JavaScript — and rightly so. A CSS rule will at worst break the look. A JS rule can read what you type into a form. Before you run someone else's snippet:
- Read it. A short, readable snippet explains itself.
- Beware obfuscated code — random variable names, long base64 strings,
eval. An honest snippet has no reason to hide. - Beware a
fetchsending data to a foreign address — that is potential exfiltration.
JustZix itself does not spy
The extension has no telemetry — it does not report which pages you visit or what you inject. The backend sees only the sync-key hash and encrypted rule bundles. The risk does not lie in the tool — it lies in the code you choose to run yourself. So write rules yourself, or run only the ones you understand.
See also
- How sync works — what the backend sees and does not
- Injection and CSP — the limits of injected code
- JustZix for a QA team — sharing with care
Install JustZix — and run only code you trust.
Rate this post
No ratings yet — be the first.