Is My Online Learning Downloader safe?
My Online Learning Downloader sends the page user object and current URL to its telemetry API when downloads start.
On supported Online Learning pages, the extension reads the page's embedded user object and adds the current URL, download action, timestamp, and extension version before posting it when ePub or asset downloads are triggered. It also derives a SHA-256 hash of the page user's email and uses that hash as the userId for a notification stream.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Download clicks send learning user data and page URL to publisher API
Downloading an EPUB or all assets in My Online Learning Downloader sends the page URL and the page's Online Learning user object to api.my-chrome-extensions.com/saveUserInteractions, tied to the download action you initiated.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user clicks a download control for an EPUB or all assets.
The extension packages the page's Online Learning user object with the current URL and download action, then posts it to the telemetry API.
- Current page URLhttps://learning.example.com/course/123/lesson/456 (illustrative)
Links the download action to the specific Online Learning page you were viewing.
- Online Learning user object{"id":"12345","role":"learner"} (illustrative)
Carries account-related page data from the learning site alongside the download event.
Where it sends data
Destinations our analysis observed My Online Learning Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.my-chrome-extensions.com
My Online Learning Downloader sends data to api.my-chrome-extensions.com. No other extension we have analysed sends data here.
- notifications.my-chrome-extensions.com
My Online Learning Downloader sends data to notifications.my-chrome-extensions.com. No other extension we have analysed sends data here.