Ad and clutter removal, a theater layout, downloads, five dark themes, live chat tooling, watch progress, chapters, transcripts, and about a hundred other toggles. Everything runs on your machine.
Pick your browser. Every download comes from this project's Releases page.
RumbleX-chrome.zip from the latest release and extract it.chrome://extensions and turn on Developer mode.Chrome shows a reminder about developer-mode extensions, and it won't update this install for you. Check back here or watch the repository for new releases. Chrome hasn't allowed self-hosted CRX installs on Windows or macOS for years, so unpacked is the honest route.
Firefox 109 and newer. The current release provides an unsigned AMO submission for temporary testing. It is not a permanently installable add-on.
RumbleX-firefox-amo-unsigned.zip from the latest release and extract it.about:debugging#/runtime/this-firefox and click Load Temporary Add-on.manifest.json. Firefox removes the temporary add-on when it restarts.A permanent RumbleX-firefox.xpi will appear only after Mozilla signs the submission. This page does not offer an unsigned ZIP as an installable XPI.
For Tampermonkey, Violentmonkey, or ScriptCat. Two builds:
Userscripts get most of the suite. The pieces that need a privileged background process stay out: the channel archive queue, alarms, native notifications, context menus, and the side panel.
Every release ships SHA256SUMS.txt. This confirms the file arrived in one piece.
sha256sum -c SHA256SUMS.txt --ignore-missingThat proves the download wasn't corrupted or swapped in transit. It doesn't prove who built it, which is the part that matters if someone puts up a copy of this project somewhere else. When a release also carries SHA256SUMS.txt.sig, you can check the origin:
ssh-keygen -Y verify -f allowed_signers -I release@rumblex -n file \
-s SHA256SUMS.txt.sig < SHA256SUMS.txtGood "file" signature means the checksums came from the key published in the repository. If either check fails, don't install the files.
RumbleX only reaches the network for things you trigger: fetching a video you chose to download, checking GitHub for a newer release, and, if you switch it on yourself, syncing settings to a private Gist you own or posting to a Discord webhook you configured. The built-in Privacy Report lists every one of these, generated from the actual manifest rather than written by hand.
Permissions stay narrow on purpose. RumbleX asks for Rumble's own domains and the ad hosts it blocks, and nothing else.
The request-level shield works differently on each runtime, so here's what actually happens:
| Runtime | Early request blocking | What we claim |
|---|---|---|
| Chrome, Edge, Brave | Scoped Declarative Net Request rules | Enforced by the browser |
| Firefox | Scoped blocking webRequest | Enforced by the browser |
| Userscript managers | Only where the manager still offers the request hook | Depends on your manager, so we don't claim it |
Current Chromium versions of Tampermonkey and Violentmonkey dropped that hook when they moved to Manifest V3. On those, the page cleanup still runs and still removes ads from the layout. It just can't cancel the request before it happens, and RumbleX says so in its own interface rather than pretending otherwise.