A Browser Extension with 30,000 Installs Exposes Twitch Users’ OAuth Tokens, Raises Security Concerns
A disturbing security flaw has been discovered in a popular browser extension for the live streaming platform Twitch. The extension, called Twitch Enhanced Viewer | JeetBot, boasts over 30,000 installs and promises to block ads, improve video playback, and bypass region restrictions on the platform. However, an investigation by application security company Socket reveals that the extension is secretly sending users’ OAuth session tokens to a commercial bot service.
The token-sending mechanism works as follows: when a user watches Twitch content with the extension installed, it captures the authorization header used by the Twitch web client and extracts the user’s OAuth token. This token is then sent through proxy servers operated by JeetBot, a Russian-language streaming and chatbot service that offers tools for Twitch, Kick, and VK Live. The proxy server’s request logs contain the token in cleartext, making it easily accessible to the software vendor.
This process occurs every time a user watches a Twitch channel, except for ten specific Russian-language channels hardcoded into the extension’s code. Socket notes that earlier versions of the extension used even more explicit mechanisms to steal credentials. The developer had previously disclosed this behavior in the product description, stating that it was necessary for the stream to run at high quality.
The data privacy disclosure for the Chrome variant of Twitch Enhanced Viewer | JeetBot claims that the developer “will not collect or use your data,” except in approved cases such as selling user data to third parties. However, this statement is contradicted by the extension’s behavior.
At the time of writing, the extension was still available in both the Chrome Web Store and the Firefox Add-Ons store. CyberNews has reached out to JeetBot for comment but has not received a response.
The Socket researchers believe that this extension poses a significant security risk to users and recommend that they remove it from their browsers immediately. Users are also advised to disconnect all sessions in Twitch and re-authenticate to invalidate any tokens that may have been forwarded. Developers should take note of the importance of avoiding routing requests with authentication headers or tokens through third-party servers.
This incident highlights the need for users to be cautious when installing browser extensions, especially those that promise to improve their streaming experience. It’s essential to carefully review an extension’s permissions and behavior before installing it, and to regularly monitor its activity. By doing so, we can reduce the risk of falling victim to security flaws like this one.
Source: Bleeping Computer — 2026-09-14