title: Is a Greasemonkey script that uses unsafeWindow secure as long as the @grant type is 'none'?
body: <p>I've written a small Greasemonkey script to add a couple of hotkeys to YouTube for controlling the volume when the video doesn't necessarily have focus:</p>
  <pre><code>// ==UserScript==
  // @name     Custom Youtube Hotkeys
  // @version  1
  // @include  https://www.youtube.com/watch*
  // @grant    none
  // ==/UserScript==
  
  var customScript_Player = unsafeWindow.document.getElementById(&quot;movie_player&quot;);
  
  window.onkeypress = function(event) {
    //ignore keypress if focused on search bar
    if (unsafeWindow.document.activeElement.tagName === &quot;INPUT&quot;) { return; }
    try {
      if (event.keyCode == 120) {
        customScript_Player.setVolume(customScript_Player.getVolume() + 5);
      } else if (event.keyCode == 122) {
        customScript_Player.setVolume(customScript_Player.getVolume() - 5);
      }
    } catch(err) { console.log(err.message); }
  };
  </code></pre>
  <p>However, I'm concerned about the security concerns raised with the use of unsafeWindow.
  As far as I can tell, it's necessary to execute JavaScript on the page elements, but I'm seeing conflicting information about what security risks it poses.</p>
  <p>I've seen a couple of discussions where it's claimed that the only security holes opened by its use come from the APIs Greasemonkey provides which are blocked using @grant    none in the script header, and that as long as grant is set to none the page can't do anything it wouldn't be able to normally.</p>
  <p>However, the wiki itself makes several warnings about avoiding unsafeWindow and doesn't seem to ever specify its only a problem when using its own API.</p>
  <p>Is the above script secure? If not, is there a safer way to inject javascript that can control the page elements?</p>
  <p>Thanks!</p>