Is M3U8 Downloader safe?
M3U8 Downloader fetches and merges HLS video segments from user-supplied URLs and saves them locally as .ts or .mp4 files.
The extension's options page accepts an M3U8 playlist URL, fetches each .ts segment in parallel (up to 6 concurrent threads), and concatenates them into a single file downloaded through the browser. AES-128 encrypted streams are supported via a bundled decryptor. The options page HTML includes an ad-network script tag (sillinesswoollen.com) and Google Analytics and Microsoft Clarity integrations, all of which are blocked from executing by the manifest's strict content security policy.
Who publishes itHelloWorld - 2 other listings from the same operator, none carrying a finding
HelloWorld - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 90k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Options Page References a Blocked Remote Script
M3U8 Downloader's options page references a remote script at sillinesswoollen.com.
The manifest's extension-page CSP allows scripts only from the extension itself, so Chrome blocks that script before any request or user data is observed.
What actually happens
You open the extension's options page.
The page contains a remote script reference that Chrome blocks under the extension's declared script policy.
Concrete fields in the shipped options page and manifest
- Remote script hostsillinesswoollen.com
This names the outside site the options page points to.
- Remote script path//sillinesswoollen.com/6a981008087a0a519c722c43126e8e0b/invoke.js
This is the exact script location embedded in the page.
- Options pageindex.html
This is the extension page that contains the remote script reference.
- Script policyscript-src 'self'; object-src 'self'
This browser-enforced rule allows extension-page scripts only from the extension package.
- Host permission scopehttps://*/*
Shows the extension can access HTTPS pages broadly, though the blocked options-page script does not run under the shipped policy.
Captured request
Chrome blocks the remote script on the extension page under the declared content security policy; no body was recorded.
The code that does this
The shipped options page contains the remote script, and the manifest blocks it
Options page script tags
index.html<body> <div id="app"></div> <script async="async" data-cfasync="false" src="//sillinesswoollen.com/6a981008087a0a519c722c43126e8e0b/invoke.js" ></script></body>Extension page and script policy
manifest.json{ "options_ui": { "page": "index.html", "open_in_tab": true }, "background": { "service_worker": "background.js" }, "host_permissions": ["https://*/*"], "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'self'" }}External hosts named by this evidence
- sillinesswoollen.com
Remote script host referenced from the extension options page.
What it can do
Permissions this extension asks for, as declared in version 1.2.11. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*