The extension is actually recommended by Mozilla, so they do not consider it harmful or dangerous.

Nothing in the extension changed - it’s open-source, so you can verify that yourself. What changed is how Mozilla labels privacy-related permissions.

Ajay, the author of SponsorBlock and DeArrow, has also raised this issue with Mozilla. He explains how the new wording can make an existing extension look like it suddenly started collecting new data, without making clear which websites it can access. You can read his post on Mozilla’s forum here: https://discourse.mozilla.org/t/the-new-data-transmission-permissions-seem-to-be-misleading-to-users/149410

The extension only uses an anonymous, randomly generated ID, and the id of the video that you liked/disliked.

• YouTube access - needed to read the current video ID and show its dislike count.
• RYD API access - needed for API requests and diagnostics.
• Online/activity data - viewing, liking, or disliking videos.
• Personally identifiable information - RYD’s random private user ID used to count votes, not your real identity.
• Website content - mainly the video ID.

The new labels sound scary, but they describe the same data the extension has always used.