Is InstaNote: Download and Save Video for IG safe?

Medium risk

InstaNote is medium risk. Downloading or saving Instagram content sends the current page URL and browser details to an Alibaba Cloud Logging endpoint, including URL/referrer context and tab-activity metadata tied to the action.

Caller Caov1.0.8.5Chrome Web Store
46Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Instagram actions send page URL and browser details to Alibaba logging.

MediumunwantedCWE-359Dynamic sandbox

Downloading or saving Instagram content sends the current page URL and browser details to an Alibaba Cloud Logging endpoint, including URL/referrer context and tab-activity metadata tied to the action.

What actually happens

You did this

The user clicks an extension action on Instagram or another supported page.

The extension did this

The extension includes the current page URL, referrer context, and browser details in a logging payload.

Captured request

POSThttps://nc-dn-us.us-west-1.log.aliyuncs.com/logstores/extensions/track

Fields in the request

  • Current page URL
    https://www.instagram.com/reel/ABC123/ (illustrative)

    Shows which Instagram or supported page was open when the extension action ran.

  • Referrer page
    https://www.instagram.com/p/XYZ789/ (illustrative)

    Provides page context that can identify the content or location associated with the action.

  • Tab activity context
    ext_download_video_chrome (illustrative)

    Connects the logged action to the browser tab and extension feature being used.

What it can do

Permissions this extension asks for, as declared in version 1.0.8.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on openai.com

    https://*.openai.com/*

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

  • Watch every request your browser makes

    webRequest

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026fbccnclbchlcnpdlhdjfhbhdehoaafeg