Is M3U8 Downloader safe?

Q: Is M3U8 Downloader safe?

M3U8 Downloader is medium risk. M3U8 Downloader's options page references a remote script at sillinesswoollen.com. The manifest's extension-page CSP allows scripts only from the extension itself, so Chrome blocks that script before any request or user data is observed.

Medium risk

M3U8 Downloader fetches and merges HLS video segments from user-supplied URLs and saves them locally as .ts or .mp4 files.

The extension's options page accepts an M3U8 playlist URL, fetches each .ts segment in parallel (up to 6 concurrent threads), and concatenates them into a single file downloaded through the browser. AES-128 encrypted streams are supported via a bundled decryptor. The options page HTML includes an ad-network script tag (sillinesswoollen.com) and Google Analytics and Microsoft Clarity integrations, all of which are blocked from executing by the manifest's strict content security policy.

HelloWorldv1.2.11Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM

ClassUNWANTED

TypeUnexpected

CWECWE-829

SourceAI SANDBOX

Options Page References a Blocked Remote Script

M3U8 Downloader's options page references a remote script at sillinesswoollen.com.

The manifest's extension-page CSP allows scripts only from the extension itself, so Chrome blocks that script before any request or user data is observed.

01EvidenceCAUSE EFFECT

What actually happens

You did this

You open the extension's options page.

The extension did this

The page contains a remote script reference that Chrome blocks under the extension's declared script policy.

02EvidenceFIELD TABLE

Concrete fields in the shipped options page and manifest

Field	Value	Why it matters
Remote script host	sillinesswoollen.com	This names the outside site the options page points to.
Remote script path	//sillinesswoollen.com/6a981008087a0a519c722c43126e8e0b/invoke.js	This is the exact script location embedded in the page.
Options page	index.html	This is the extension page that contains the remote script reference.
Script policy	script-src 'self'; object-src 'self'	This browser-enforced rule allows extension-page scripts only from the extension package.
Host permission scope	https:///	Shows the extension can access HTTPS pages broadly, though the blocked options-page script does not run under the shipped policy.

03EvidenceNETWORK CAPTURE

Captured request

GET//sillinesswoollen.com/6a981008087a0a519c722c43126e8e0b/invoke.js

Chrome blocks the remote script on the extension page under the declared content security policy; no body was recorded.

04EvidenceCODE COMPARE

The code that does this

The shipped options page contains the remote script, and the manifest blocks it

What it actually does

Show shipped source

Options page script tagsindex.html

<body>
  <div id="app"></div>
  <script
    async="async"
    data-cfasync="false"
    src="//sillinesswoollen.com/6a981008087a0a519c722c43126e8e0b/invoke.js"
  ></script>
</body>

Extension page and script policymanifest.json

{
  "options_ui": {
    "page": "index.html",
    "open_in_tab": true
  },
  "background": {
    "service_worker": "background.js"
  },
  "host_permissions": ["https://*/*"],
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  }
}

05EvidenceTHIRD PARTY LIST

External hosts named by this evidence

sillinesswoollen.com
Remote script host referenced from the extension options page.