Is Exta: Pro downloader for Instagram safe?
Exta is medium risk. Each browser start, this Instagram downloader contacts metricuser.com with a persistent per-install ID, generated once and stored in sync storage. The server's response remotely configures behavior, including a tab-injection feature.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Persistent User ID Sent to metricuser.com on Every Browser Start
Each browser start, this Instagram downloader contacts metricuser.com with a persistent per-install ID, generated once and stored in sync storage.
The server's response remotely configures behavior, including a tab-injection feature.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You start your browser with this extension installed, no other action required.
The extension immediately contacts metricuser.com and transmits a persistent identifier unique to your install.
The request fires before any Instagram tab is opened. A 6-hour rate limit prevents duplicate pings per session.
JSON object with remote-config keys: blh, kex, cov, source. Values control tab-injection and feature-flag behavior stored locally.
- Your persistent install IDdk1in7ehr-8dy0vdi-7uh2nc3r-4l3foe9tw0
A unique ID generated on first install, stored in sync storage, so it follows you across every signed-in Chrome device.
- Extension type tagexta
A hardcoded label telling the server which extension product is pinging it. The same for every user.
- Advertising consent flagadvertising_accepted=true
Present and set to true when you have accepted the advertising consent prompt inside the extension options.
ID generation and startup ping, from bg.js
ID generation — readable
js/bg.jsfunction generateUserId() { const timestamp = Math.round(Date.now() / 1000).toString(); const alpha = 'abcdefghijklmnopqrstuvwxyz'; const randChars = (min, max) => Array.from({ length: min + Math.floor(Math.random() * (max - min + 1)) }, () => alpha[Math.floor(26 * Math.random())]).join(''); let id = randChars(1, 3); let segLen = id.length; for (let i = 0; i < timestamp.length; i++) { id += timestamp[i]; id += Math.random() < 0.85 ? randChars(1, 3) : ''; segLen = id.length - id.lastIndexOf('-') - 1; const isLast = i === timestamp.length - 1; if ((!isLast && segLen >= 8) || (!isLast && segLen >= 4 && Math.random() < 0.25)) { id += '-'; segLen = 0; } } return id; // e.g. "dk1in7ehr-8dy0vdi-7uh2nc3r-4l3foe9tw0"}Startup ping — readable
js/bg.jsconst RATE_LIMIT_MS = 216e5; // 6 hoursfunction sendStartupPing() { chrome.storage.local.get('lrq').then(stored => { if (stored.lrq && stored.lrq + RATE_LIMIT_MS > Date.now()) return Promise.reject('not_time_to_fetch'); }) .then(() => Promise.all([ getFlag('advertising_accepted'), // user's ad-consent flag getUserId() // persistent sync-storage ID ])) .then(([advertisingAccepted, userId]) => { const params = { u: userId, me: 'exta' }; if (advertisingAccepted) params['advertising_accepted'] = true; const url = 'https://periodic.metricuser.com/promo.json?' + new URLSearchParams(params); return fetch(url); }) .then(res => res.json()) .then(config => { chrome.storage.local.set({ lrq: Date.now() }); // update rate-limit timestamp if (config.blh) chrome.storage.local.set({ blh: config.blh }); if (config.kex !== undefined) chrome.storage.local.set({ kex: config.kex }); // feature flag if (config.cov) chrome.storage.local.set({ cov: config.cov }); // coverage list if (config.source) chrome.storage.local.set({ source: config.source }); });}sendStartupPing(); // runs immediately on SW startup- periodic.metricuser.com
Receives startup pings with the persistent user ID. Returns remote config controlling feature flags, including tab-injection. Domain registrant not publicly disclosed.