Is LinkedIn Video Downloader safe?
LinkedIn Video Downloader sends the user's signed-in Google account email to an unrelated third-party licensing server.
On opening the popup, the extension reads the user's signed-in Chrome/Google account email via chrome.identity.getProfileUserInfo() and sends it in a plaintext URL to soletstalkapp.com to check subscription status, without showing a consent screen. Separately, each time the download button is used on a LinkedIn post, the extension sends the viewer's own LinkedIn profile URL, the post's URL and text, and the video URL to a vendor analytics endpoint on Alibaba Cloud, tied to a persistent per-install identifier stored in the browser.
Who publishes itSo Lets Talk Digital - 4 other listings from the same operator, 1 of them carrying a finding
So Lets Talk Digital - 4 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 828 users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
LinkedIn Video Downloader sends your signed-in Google email to an unrelated site
Code analysis shows the popup reads your signed-in Chrome/Google account email and sends it in a GET request to soletstalkapp.com, a domain unrelated to LinkedIn or the extension's stated purpose.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You click the toolbar icon while signed into Chrome with a Google account.
No interactive consent screen is shown before the account email is read.
The popup reads your account email and sends it to soletstalkapp.com in a GET request.
The response is used only to show or hide a 'please subscribe' panel in this version.
- Your Google account emailemail=jane.doe@gmail.com
Identifies you personally to a domain with no stated relationship to LinkedIn Video Downloader.
- Product identifierid=33
Tags the request as belonging to this specific product for a subscription lookup.
Popup code reading and transmitting the account email
Deobfuscated equivalent (this file ships unminified; no transformation was needed)
popup/index.981017d0.js:1-33getUserIdentity();var email;var subscribe_user = false;async function getUserIdentity() { await chrome.identity.getProfileUserInfo(function(userInfo) { console.log(userInfo); const url = 'https://soletstalkapp.com/stats/ispro' const PRODUCT_ID = 33; console.log('clicked'); async function isSubscribe() { const t = await fetch(`${url}?email=${userInfo.email}&id=${PRODUCT_ID}`); const n = await t.json(); subscribe_user = n; isUserSubscribe(subscribe_user); } isSubscribe(); });}function isUserSubscribe(userSubscribe){ if(userSubscribe == false){ document.getElementById('popup').style.display = 'none'; document.getElementById('pleaseSubscribe').style.display = 'block'; }}- soletstalkapp.com
Receives the signed-in account email and a product ID on every popup open, then returns a subscription status. Unrelated in name or branding to LinkedIn Video Downloader.
Reproduces the request the popup sends, so you can confirm the account email is placed in the query string sent to soletstalkapp.com.
- Chrome with the extension installed
- A Chrome profile signed into a Google account
// Run inside the extension's popup DevTools console after opening the popup.chrome.identity.getProfileUserInfo(function (userInfo) { const url = 'https://soletstalkapp.com/stats/ispro'; const PRODUCT_ID = 33; const requestUrl = `${url}?email=${userInfo.email}&id=${PRODUCT_ID}`; console.log('Request the extension sends:', requestUrl);});- 1Sign into Chrome with a Google account.
- 2Install the extension and open its popup.
- 3Open the popup's DevTools console.
- 4Paste and run this script.
- 5Compare the logged URL to the captured network request.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on linkedin.com
https://*.linkedin.com/*
Read and change your data on fonts.googleapis.com
https://fonts.googleapis.com/*
See every page you navigate to, as you navigate to it
webNavigation
Start, monitor and manage your downloads
downloads
Store data in your browser
storage
Sign you in with your Google account
identity
See the email address of your Google account
identity.email
Where it sends data
Destinations our analysis observed LinkedIn Video Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- extension-us.us-west-1.log.aliyuncs.comwidely used
LinkedIn Video Downloader sends data to extension-us.us-west-1.log.aliyuncs.com. A widely used service: 28 other extensions we have analyzed send data here.
- soletstalkapp.com
LinkedIn Video Downloader sends data to soletstalkapp.com. 2 other extensions we have analyzed send data here.