Is Super Video Speed Controller safe?
Super Video Speed Controller is critical risk. On startup the extension sends an install ID and extension ID to db7.org, downloading URL rules updatable anytime without a store update. These load into Chrome's request interception to redirect, alter params, or modify headers site-wide.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote-Controlled URL Rewriting via db7.org
On startup the extension sends an install ID and extension ID to db7.org, downloading URL rules updatable anytime without a store update.
These load into Chrome's request interception to redirect, alter params, or modify headers site-wide.
- Severity
- Critical unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You install or start the browser with this extension enabled.
The extension contacts db7.org with your install ID and downloads a set of URL rewriting rules that it installs into Chrome's request interception system.
Rules can redirect, strip query parameters, add query parameters, modify request headers, or regex-rewrite URLs for any navigation you make. They also rewrite link destinations directly on every page you visit.
Found one active rule in storage: matches tube.rebellion.global, strips profile-999 tracking params. Server updates rules anytime.
- Location
- chrome.storage.local, keys 'rules' and 'rp' (remove-parameter profiles)
{ "rp": { "999": [ "ref", "utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content" ] }, "rules": [ { "a": [], "i": 1001, "p": 1, "r": "^https://tube.rebellion.global/w/.*", "t": "redirect", "rp": [ 999 ] } ]}- Your install IDef19f7c4-7e52-442e-484b-9cc1929e4a84
A UUID made once on install, stored permanently. Sent on every rule refresh, letting db7.org track your install over time.
- Extension IDchnccghejnflbccphgkncbmllhfljdfa
Chrome's unique ID for this install. With the install ID, it identifies both the extension and your specific copy.
The rule fetch and apply logic, from the extension's minified source.
Startup: fetch rules from server
// Called on startup (and on every 'reload' alarm, every 120 minutes).function fetchAndApplyRules() { chrome.storage.sync.get({ installId: '' }, (stored) => { if (!stored.installId) { // First run: generate a persistent UUID and save it const newId = generateUUID(); installId = newId; chrome.storage.sync.set({ installId: newId }); } else { installId = stored.installId; } // Fetch server-controlled rules, keyed to this specific install fetch(`https://db7.org/api/settings?user_id=${installId}&extension_id=${chrome.runtime.id}`) .then(r => r.json()) .then(data => applyRules(data)) .catch(() => {}); });}Apply fetched rules to Chrome's declarativeNetRequest
// Takes the server response and installs rules into Chrome's URL interception engine.async function applyRules(response) { const rules = response ? response.rules : []; const removeParamProfiles = response ? response.rp : {}; // Persist to local storage (content script reads from here too) removeParams = removeParamProfiles; await chrome.storage.local.set({ rules, rp: removeParamProfiles }); // Clear all existing dynamic rules, then reinstall with new set const existing = await chrome.declarativeNetRequest.getDynamicRules(); const existingIds = existing.map(r => r.id); if (existingIds.length > 0) await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existingIds }); // Install each rule from the server response if (response !== false && rules.length > 0) for (const rule of rules) await installSingleRule(rule); // Schedule next refresh in 120 minutes chrome.alarms.create('reload', { delayInMinutes: 120 }); // Notify any open tabs that rules changed chrome.runtime.sendMessage({ name: 'rulesUpdated', rules, rp: removeParamProfiles, install_id: installId, extensionId: chrome.runtime.id });}Rule types the server can deploy
// Four rule types the server can send://// 1. 'allow' — skip all other rules for matching URLs// 2. 'redirect' — strip query params (from profile) + add/replace params// 3. 'header' — set an arbitrary request header (e.g. Referer) on matching URLs// 4. 'slug' — full regex-substitution redirect (change the URL path)//// All rules match only 'main_frame' resource type (top-level navigations).async function installSingleRule(rule) { const { i: ruleId, p: priority, t: type, r: regexFilter, s: slugSubstitution, h: headerName, a: args, rp: removeProfileIds } = rule; if (type === 'allow') { chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: ruleId, priority, action: { type: 'allow' }, condition: { regexFilter, resourceTypes: ['main_frame'] } }], removeRuleIds: [ruleId] }); } else if (type === 'redirect') { // Collect query params to remove from the referenced profiles const paramsToRemove = []; for (const profileId of removeProfileIds || []) if (Array.isArray(removeParams[String(profileId)])) removeParams[String(profileId)].forEach(p => paramsToRemove.push(p)); // Parse key=value pairs to add/replace const paramsToAdd = []; for (const entry of args || []) { ... paramsToAdd.push({ key, value }); } chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: ruleId, priority, action: { type: 'redirect', redirect: { transform: { queryTransform: { removeParams: paramsToRemove, addOrReplaceParams: paramsToAdd } } } }, condition: { regexFilter, resourceTypes: ['main_frame'] } }], removeRuleIds: [ruleId] }); } else if (type === 'header' && headerName) { chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: ruleId, priority, action: { type: 'modifyHeaders', requestHeaders: [{ header: headerName, operation: 'set', value: args[0] || '' }] }, condition: { urlFilter: regexFilter, resourceTypes: ['main_frame'] } }], removeRuleIds: [ruleId] }); } else if (type === 'slug') { // Full regex substitution — can rewrite entire URL paths chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: ruleId, priority, action: { type: 'redirect', redirect: { regexSubstitution: slugSubstitution } }, condition: { regexFilter, resourceTypes: ['main_frame'] } }], removeRuleIds: [ruleId] }); }}On every browser startup
Rules are fetched from db7.org on every browser startup and on initial install. After the first successful fetch, a chrome.alarm named 'reload' is set to fire every 120 minutes, re-fetching and replacing all dynamic rules with whatever the server returns at that time.
- db7.org
Serves the rule set; receives the per-install UUID and extension ID on every fetch. Not disclosed as a recipient in the store listing.
Run this in the Chrome DevTools console (on any page) to read the URL rewriting rules currently loaded by Super Video Speed Controller from its local storage. Shows you exactly which URLs are being intercepted and what the extension is doing to them.
- Chrome with Developer mode enabled
- Super Video Speed Controller extension installed
// check-super-video-speed-rules.js// Reads the URL rewriting rules currently installed by Super Video Speed Controller.// Run in Chrome DevTools console on any page while the extension is active.(async () => { // Ask the extension's content script to relay the storage contents // Alternatively: open chrome://extensions, find the extension's service worker, // open its DevTools, and run this there directly: const EXT_ID = 'chnccghejnflbccphgkncbmllhfljdfa'; // Method 1: If you have access to the extension's service worker DevTools // (chrome://extensions -> click the 'service worker' link -> Console) const stored = await new Promise(resolve => chrome.storage.local.get(['rules', 'rp'], resolve) ); const rules = stored.rules || []; const profiles = stored.rp || {}; if (rules.length === 0) { console.log('[SVSC] No rules currently loaded.'); return; } console.log(`[SVSC] ${rules.length} active rule(s) from db7.org:\n`); for (const rule of rules) { const typeLabel = { allow: 'ALLOW', redirect: 'REDIRECT (param strip/add)', header: 'MODIFY HEADER', slug: 'REGEX REWRITE' }[rule.t] || rule.t; console.log(` Rule ${rule.i} [priority ${rule.p}] — ${typeLabel}`); console.log(` Matches: ${rule.r}`); if (rule.rp?.length) { const paramsToStrip = rule.rp.flatMap(id => profiles[String(id)] || []); console.log(` Strips params: ${paramsToStrip.join(', ')}`); } if (rule.a?.length) console.log(` Adds/replaces params: ${rule.a.join(', ')}`); if (rule.h) console.log(` Sets header: ${rule.h} = ${rule.a?.[0] || ''}`); if (rule.s) console.log(` Regex substitution: ${rule.s}`); console.log(); } console.log('Remove-param profiles:', profiles); console.log('\n[SVSC] Install ID (sent to db7.org on every refresh):'); const sync = await new Promise(resolve => chrome.storage.sync.get(['installId'], resolve)); console.log(' ', sync.installId || '(not yet set)');})();- 1Open chrome://extensions with the extension enabled.
- 2Click its 'service worker' link to open background DevTools.
- 3Paste the script in Console, press Enter.
- 4Output lists each active rewriting rule from db7.org.
Persistent Install ID Sent to db7.org on Every Check-In
The extension makes a permanent ID on first run, stored in synced storage.
On every db7.org check-in for rules, it sends that ID with the store ID, letting db7.org link check-ins to your profile.
Not disclosed as a recipient.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install the extension, or start your browser with it already installed.
The extension reads a permanent install ID from synced storage, generating one on first run, and sends it to db7.org with the extension's store ID.
The same ID is sent again every 2 hours for as long as the extension stays installed.
- Your install ID901e94d5-968c-41f9-4ef6-e1db1fc954c9
A permanent ID made on first run. Persists until reinstall, letting db7.org recognize the same browser profile across check-ins.
- Extension IDchnccghejnflbccphgkncbmllhfljdfa
The Chrome Web Store identifier for this extension, sent alongside your install ID on every check-in.
200 OK, JSON settings payload (URL-rewriting rules)
- db7.org
Receives the persistent install ID and extension ID on every check-in. Ownership and privacy-policy information for this domain are not disclosed in the Chrome Web Store listing.
What it can do
Permissions this extension asks for, as declared in version 1.3.2.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Schedule its own background tasks
alarms
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Block and redirect the requests your browser makes
declarativeNetRequest