A Twitch extension was quietly forwarding live sessions. Here's what that says about anything else you've installed.

On September 11, researchers at Socket’s Threat Research Team published a writeup on a browser extension called “Twitch Enhanced Viewer | JeetBot.” It had about 30,000 users on Chrome and another 552 on Firefox — small as these things go, popular enough to matter. It promised the usual bundle of stream-viewing conveniences: fewer ads, region-unlocked video, higher quality. What it also did, quietly, in the background, was read the OAuth token Twitch’s own web client uses to prove you’re logged in, and hand a copy of it to JeetBot — a commercial russian-language bot service that sells viewer and chat bots for Twitch, Kick, and VK Live.

What actually left your browser

A login token isn’t your password, but it’s just as good to an attacker — sometimes better. It’s the credential your browser already presents on every request once you’ve logged in, and whoever holds a copy of it can act as you without needing your password or your second factor. Socket describes this one as granting access to chat, whispers, and account settings. That’s the entire point of a token like this: it lets you stay logged in without retyping anything. It’s also why losing one is quietly worse than it sounds — there’s no two-factor prompt standing between an attacker and your account, because from the server’s point of view, you already passed that check.

According to Socket’s analysis, the extension delivered its ad-free and region-unlocked video by redirecting Twitch’s video requests through proxy servers JeetBot operates. The extension’s content script read the Authorization header Twitch’s client sends with its own requests, handed it to the extension’s background worker, and appended the token to that redirect as an &auth= parameter. Because the token rode along in a URL rather than, say, inside the request itself, it was written in plain text into the proxy’s own server logs. Not smuggled out through a clever channel — just sitting there, in the ordinary access logs any web server keeps, for anyone at JeetBot with a reason to go looking.

That wasn’t the first version, either. According to CyberInsider’s reporting, an earlier build from January 2026 skipped the proxy entirely and posted captured tokens straight to an endpoint on JeetBot’s own infrastructure. The quieter log-file route came later.

And the code had a carve-out. For a hardcoded list of ten channels — russian-language streamers, several of them well-known Counter-Strike figures — the token was left off the redirect whenever you were watching one of them. Socket doesn’t say why those ten were spared, and it found no evidence of what, if anything, was done with the tokens that were collected. But nobody writes an allowlist by accident. Somebody at JeetBot decided which streams were safe to leave alone and which ones weren’t — and read alongside a build that sent tokens straight to JeetBot’s own server, our reading is that this was a choice about whose sessions to collect, not a bug.

Socket published on September 11, with both store listings still live. Only after that did the JeetBot team get in touch. According to Socket’s update on September 16, the JeetBot crew “acknowledged” the security risk (as if that was news to them), admitted that the store description and privacy policy hadn’t disclosed it (no shit), and shipped version 85.8.7, which stops forwarding the token. That version reached Firefox within days. On Chrome, the old build kept forwarding tokens until the change cleared Web Store review on September 20 — nine days after the writeup. The Chrome listing now carries JeetBot’s own explanation: that previous versions sent your token to its server because it “was necessary for 1080/1440p quality functionality.” None of it explains the ten-channel allowlist. An acknowledgement after being caught is not the same as telling users up front, and JeetBot’s operators knew exactly what their code did for however long it went unnoticed. The only thing that changed on September 11 is that someone else discovered it.

The part that isn’t specific to Twitch

Here’s why this belongs in a password manager’s blog and not just a gaming-security roundup.

A browser extension is, by design, granted a kind of access most software never gets: it can read what’s on a page, inject its own code into that page, and in many cases act on your behalf using whatever session or credential is already active. That access is the entire reason extensions are useful — an ad blocker has to see the page to block anything on it, a password manager has to see the login form to fill it. None of that is a design flaw. It’s the deal you make every time you install one.

What JeetBot’s extension shows is what that deal actually costs when the party on the other end treats it as an opportunity. You cannot audit what an extension does with the access it holds just by looking at what it promised to do. The permissions dialog told you it could read and change data on Twitch’s pages. It did not, and could not, tell you it would put your live session in a russian bot service’s server logs, with a carve-out for ten channels of its choosing. That gap — between the access an extension is granted and the behavior nobody outside its own code can verify — is the actual subject of this story, and it applies to every extension in your browser, not just the ones with a suspiciously large permissions list.

It applies with particular force to a password manager’s extension, because that’s the one piece of software you deliberately ask to handle the most sensitive material you have. We’ve written before about how a single invisible click can trick a password manager’s extension into releasing a credential — a different mechanism than this one, but the same underlying question: what happens to the access an extension has, at the moment something asks it to use that access? In that piece, the answer was to move the decision outside the browser entirely — an approval the Vauz app shows, which a web page can’t draw over or fake: Touch ID, your V-Key, or, if you’ve set up neither, a confirmation you have to click.

The Twitch case is the same question from the opposite direction: not “can a page trick the extension,” but “what if the extension itself can’t be trusted.” The honest answer there isn’t a cleverer permission model — it’s giving the extension as little as possible to leak in the first place. That’s why the Vauz browser extension holds no vault, stores no passwords, and has no key that opens your vault. It can’t decrypt your vault, and it can’t release a credential on its own initiative — it can only ask the Vauz app, a separate standalone program, for the login to one site, and the app asks you before anything leaves. It’s an errand runner: it carries a request in and carries back only what you approved.

That doesn’t make it magic, and it’s important to be clear about where the line is. An extension runs inside the pages it works on, so anything that gets filled into a page, or typed into one, is within reach of it — ours included, and any other extension you’ve given access to that site. What the design rules out is the thing JeetBot’s extension did at scale: there is no vault inside the Vauz extension to copy out, and no standing token that quietly lets it help itself. Every login it receives is one you approved, for a site the prompt named.

That’s also the thread running through keeping a vault on-device rather than in someone else’s cloud: every additional place your data can sit, or pass through, is another place that has to be trusted, audited, and believed. A Twitch extension routing your session through a russian bot service’s logs is exactly the failure mode that principle is built to limit by construction — not by promising better behavior, but by making sure there’s less for bad behavior to reach.

What to actually do about it

If you ran this extension, firstly, uninstall it from your browser, then, in Twitch’s security settings, sign out of every session to invalidate any token that was forwarded. After that, you can log back into your Twitch account.

None of this means uninstall every extension you own. It means treating “what can this extension see, and does it need to” as an ongoing question, not a one-time permissions click you approved two years ago and forgot.

A few concrete habits, in order of how much they’d have helped with this one:

• Open your browser’s extension list today and read it like a stranger would. Chrome: chrome://extensions. Firefox: about:addons. Anything you don’t recognize, don’t remember installing, or can’t explain the purpose of in one sentence — remove it. For the ones you keep, ask what each needs to do its job. A video-quality tool that needs your Twitch login is worth a second look.
• Check what each extension can actually access, not just whether it’s still installed. Both browsers let you see per-site permissions; “on all sites” is a broader grant than most extensions need, and it’s worth asking, for each one, why it has that.
• Treat “small extension, niche site” as no safer than “big extension, popular site.” JeetBot’s extension had ~30,000 users. That’s a rounding error next to the household names, and it still made it into the Chrome Web Store, stayed listed after a public disclosure, and kept forwarding tokens on Chrome for nine more days until the change cleared review.
• Remember that a login token is not covered by two-factor authentication. If you’re ever told your account was accessed without your password being typed anywhere, this is one of the mechanisms that explains how — worth knowing before it happens to you, not after.

The current version on both stores no longer forwards tokens. That changed only after the story went public, and that distinction is the actual lesson. The question it raised isn’t something a patch closes. It’s the same question worth asking before installing any extension that touches something you’d mind losing — including, and maybe especially, the one that fills in your passwords: what does this actually hold, and what would it do if nobody was watching?

If you want to see what that question looks like answered rather than assumed, Vauz  is free to try, and free for life on its free plan.