Is LinkedIn Video Downloader safe?

Medium risk

LinkedIn Video Downloader sends your signed-in Chrome profile email to app.soletstalkapp.com each time the popup opens.

When the popup opens, the extension reads the email of the Chrome profile you are signed into and sends it in a request URL to app.soletstalkapp.com for a subscription check. The response decides whether a subscribe panel is shown. No consent step or sign-in screen precedes the request.

So Lets Talk Digitalv1.0.1Chrome Web Store
49Risk
Who publishes it

So Lets Talk Digital - 13 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
So Lets Talk Digital
Declared legal entity
So Lets Talk Digital
Website
soletstalkapp.com/contact

Same store account

13 other listings published from this account, 2k+ users between them. 3 of them carry a finding.

So Lets Talk Digital - WA Sender810LowSLTD - Business Tools Sender273MediumWAPP Group Sender88LowJustdial Lead Generator80CleanWA Plus Bulk Sender75CleanSLTD WA Sender74Low7 more listings in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

s.green23213.ml
Also called by 1 other listing: LinkedIn Video Downloader

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup sends your Chrome profile email to app.soletstalkapp.com on every open

Code analysis shows the popup reads the signed-in Chrome profile email and sends it in a URL query string to app.soletstalkapp.com for a subscription check on each open.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open the extension popup from the toolbar.

The extension did this

The popup sends the email of your signed-in Chrome profile to app.soletstalkapp.com.

No sign-in screen or consent prompt appears in the popup code before the request.

The code that does this

popup/index.981017d0.js, lines 5-26

Readable version

Same code; the file ships unminified

popup/index.981017d0.js
async function getUserIdentity() {  await chrome.identity.getProfileUserInfo(function(userInfo) {    // email = user.email;    console.log(userInfo);    const url = 'https://app.soletstalkapp.com/stats/ispro'    const PRODUCT_ID = 33;    // console.log(email);    console.log('clicked');    async function isSubscribe() {      const t = await fetch(`${url}?email=${userInfo.email}&id=${PRODUCT_ID}`);      const n = await t.json();      console.log(typeof(n))      console.log(n)      subscribe_user = n;      isUserSubscribe(subscribe_user);    }    isSubscribe();    console.log(typeof(subscribe_user));    });
Query parameters in the request
  • Profile email
    jane.doe@example.com (illustrative)

    Email of the account signed in to Chrome, sent unencoded in the URL.

  • Product id
    33

    Fixed number identifying this extension to the server.

Where the email goes
    • app.soletstalkapp.com

    Receives the email on /stats/ispro and returns a subscription status; not a Google or browser-vendor host.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on linkedin.com

    https://*.linkedin.com/*

  • Read and change your data on fonts.googleapis.com

    https://fonts.googleapis.com/*

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed LinkedIn Video Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • app.soletstalkapp.com

    LinkedIn Video Downloader sends data to app.soletstalkapp.com. 5 other extensions we have analysed send data here.