What a theme can do

The iframe’s isolation: what is allowed and what is not.

Themes run in an isolated iframe (null origin, without allow-same-origin) and with a strict security policy:

• ✅ Any HTML/CSS/JS you want, animations, canvas, WebGL, video.
• ✅ Images and videos from the library (http://ejg-media.localhost) and the theme’s own files in their tags (<img>, <link>, <script>, fonts, audio, video) or with a JS module import.
• ❌ fetch() of the theme’s files: fetch only reaches ejg-media. For data, use a JS module (export default {…}).
• ❌ The internet (fetch, external fonts or images): put what you need in the theme folder.
• ❌ Access to the disk, to other programs or to Tauri: only what window.ejg offers.
• ❌ localStorage/IndexedDB: use ejg.storage.

That is why installing someone else’s theme is safe. At most it can launch games from your library, open launcher screens, or manage downloads (only in the downloads folder, or in one you choose in the dialog, and the installer always asks for administrator permission).