Privacy

This Chrome Manifest V3 helper corrects media CORS and declared Origin/Referer headers for one configured website and approved HTTPS CDN domains. Playback and direct media requests stay in the website. The extension never fetches, relays, decodes or stores media bytes.

The website's public domain/header profile is validated and bundled during the build. The extension fetches no configuration, runs no remote code and makes no independent network connection. Domains and source headers are readable in the package and displayed before approval. Changed public settings require new approval; code-only updates retain it. Existing host grants are reused.

The enabled setting and approved public website/domain/source settings are saved in storage.local. Chrome retains native domain grants. Session network rules contain only public header/domain settings and tab IDs. They survive service worker suspension, but disappear on browser restart or extension update. The worker queries website tabs to select their IDs and checks their current URL in memory; page URLs and titles are never stored or sent elsewhere. No media URL, signed token, request ID, playback state, history, analytics, telemetry or storage.sync is retained. No content scripts are installed. Private browsing is disabled. Obsolete domain grants are removed when the worker wakes. Uninstalling removes the extension's settings and grants.

Only two API permissions are required: declarativeNetRequestWithHostAccess for bounded native header rules, and storage for local preferences. Website and CDN host grants are optional and requested together by a trusted click on Privacy after displaying all access. The source-header website itself requires no host access. Chrome also manages access in the extension details.

Rules select website tab IDs, top-level and initiating domains, approved HTTPS media destinations, GET/HEAD/OPTIONS and media/XHR requests. The exact configured tab origin and port are checked when rules are reconciled. Chrome rules match initiating and top-level hostnames, including subdomains; they cannot check each request's full initiating origin or distinguish frame IDs. Embedded documents from the approved hostname, including another scheme or port allowed by the native grants, can also match inside an enabled tab. Navigation checks are asynchronous. This Chrome version does not offer Firefox's blocking origin/frame guard or cancellation of in-flight requests.

Source rules change only Origin and root Referer. CORS Allow-Origin is the exact configured website and credentials are disabled. Existing Vary values are preserved with Origin appended; redundant Origin tokens are harmless. HTTP status, body, CSP, cache policy, Cookie, Authorization and Range are unchanged. The website and CDN see their normal requests and the user's IP address under their own privacy practices.

Turning off removes session rules and retains native grants. Native rule changes and access revocation cannot undo already processed headers or media; in-flight or buffered media may continue. A failed native removal is reported as unconfirmed. Chrome access controls can further restrict these grants. Reload the website after granting access. Expired links, server denials, unsupported codecs and website CSP are outside the helper's capabilities.