Is Hulu 同時字幕で英語学習 safe?

High risk

Hulu 同時字幕で英語学習 is high risk. The shipped Hulu page script checks a GCS manifest on Hulu Japan pages. If the flag is set, it loads and runs storage.googleapis.com/niko-extension/hulu/mv3/content_inserted.js in the page, gaining access to its content, URL, and storage.

72Risk
Who publishes it

niko - 2 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

2 other listings published from this account, 40k+ users between them. 1 of them carries a finding.

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

eowp.alc.co.jp
Also called by 1 other listing: 英辞郎 on the WEB 拡張機能

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote Update JavaScript on Hulu Pages

The shipped Hulu page script checks a GCS manifest on Hulu Japan pages.

If the flag is set, it loads and runs storage.googleapis.com/niko-extension/hulu/mv3/content_inserted.js in the page, gaining access to its content, URL, and storage.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open a Hulu Japan page while the extension is active.

The extension did this

The extension checks a remote manifest and, when the manifest enables the update, loads a JavaScript file from Google Cloud Storage into that page.

Captured request
GEThttps://storage.googleapis.com/niko-extension/hulu/mv3/manifest.json

The shipped code expects a JSON response and branches on the response's update field.

Data available to the remotely loaded page script
  • Hulu page content
    Subtitle text and player controls on a Hulu watch page (illustrative)

    The loaded script runs on the Hulu page, so it can read visible page elements that ordinary Hulu page JavaScript can read.

  • Hulu page URL
    https://www.hulu.jp/watch/60123456 (illustrative)

    The page address can reveal which Hulu page or title is open.

  • Hulu page storage
    HDSFLEGSID in Hulu localStorage (illustrative)

    The script can use storage that belongs to the Hulu page origin, including extension-created records saved there.

The code that does this

Manifest-controlled remote script injection

Readable version

Content script injects the page-world bundle

content.js
window.addEventListener("DOMContentLoaded", () => {  const script = document.createElement("script");  script.src = chrome.runtime.getURL("content_inserted.js");  script.onload = function () {    this.remove();  };  (document.head || document.documentElement).appendChild(script);});

Page-world bundle checks Google Cloud Storage and appends the remote file

content_inserted.js
const emergencyScriptId = `${APP_NAME}GoogleCloudInsertMinJs`;new Promise((resolve, reject) => {  if (document.getElementById(emergencyScriptId)) {    console.log("Emergency update content_inserted.js already exists");    return resolve(false);  }  new Promise((resolveManifest, rejectManifest) => {    const xhr = new XMLHttpRequest();    xhr.responseType = "json";    xhr.open("GET", "https://storage.googleapis.com/niko-extension/hulu/mv3/manifest.json", true);    xhr.timeout = 10000;    xhr.onload = () => xhr.status === 200 ? resolveManifest(xhr.response) : rejectManifest();    xhr.onerror = () => rejectManifest();    xhr.ontimeout = () => rejectManifest();    xhr.send(null);  })    .then((manifest) => manifest.update ? resolve(true) : resolve(false))    .catch(() => resolve(false));}).then((enabled) => {  if (!enabled) {    return startBundledExtensionCode();  }  return new Promise((resolve, reject) => {    const src = "https://storage.googleapis.com/niko-extension/hulu/mv3/content_inserted.js";    const script = document.createElement("script");    script.id = emergencyScriptId;    script.onload = () => resolve();    script.onerror = () => reject();    script.setAttribute("type", "text/javascript");    script.setAttribute("src", src);    (document.head || document.documentElement).appendChild(script);  }).catch(() => startBundledExtensionCode());});
Remote hosts involved in the update path
    • storage.googleapis.com

    Hosts the niko-extension/hulu/mv3 manifest and the JavaScript file loaded when the manifest enables the update.

What it can do

Permissions this extension asks for, as declared in version 2.5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on www.hulu.jp

    https://www.hulu.jp/

  • Store data in your browser

    storage

Updated 30 September 2026lmmahellpnmhbpmimpebhikpjhiojhok