Is Super Video Speed Controller safe?

Critical risk

Super Video Speed Controller is critical risk. On startup the extension sends an install ID and extension ID to db7.org, downloading URL rules updatable anytime without a store update. These load into Chrome's request interception to redirect, alter params, or modify headers site-wide.…

ZSK MOBILE LTDv1.3.2.3Chrome Web Store
96Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote-Controlled URL Rewriting via db7.org

On startup the extension sends an install ID and extension ID to db7.org, downloading URL rules updatable anytime without a store update.

These load into Chrome's request interception to redirect, alter params, or modify headers site-wide.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You install or start the browser with this extension enabled.

The extension did this

The extension contacts db7.org with your install ID and downloads a set of URL rewriting rules that it installs into Chrome's request interception system.

Rules can redirect, strip query parameters, add query parameters, modify request headers, or regex-rewrite URLs for any navigation you make. They also rewrite link destinations directly on every page you visit.

What's stored on your device

Found one active rule in storage: matches tube.rebellion.global, strips profile-999 tracking params. Server updates rules anytime.

Location
chrome.storage.local, keys 'rules' and 'rp' (remove-parameter profiles)
Contents
{  "rp": {    "999": [      "ref",      "utm_source",      "utm_medium",      "utm_campaign",      "utm_term",      "utm_content"    ]  },  "rules": [    {      "a": [],      "i": 1001,      "p": 1,      "r": "^https://tube.rebellion.global/w/.*",      "t": "redirect",      "rp": [        999      ]    }  ]}
What the extension sends to db7.org on every startup and refresh
  • Your install ID
    ef19f7c4-7e52-442e-484b-9cc1929e4a84

    A UUID made once on install, stored permanently. Sent on every rule refresh, letting db7.org track your install over time.

  • Extension ID
    chnccghejnflbccphgkncbmllhfljdfa

    Chrome's unique ID for this install. With the install ID, it identifies both the extension and your specific copy.

The code that does this

The rule fetch and apply logic, from the extension's minified source.

Readable version

Startup: fetch rules from server

// Called on startup (and on every 'reload' alarm, every 120 minutes).function fetchAndApplyRules() {  chrome.storage.sync.get({ installId: '' }, (stored) => {    if (!stored.installId) {      // First run: generate a persistent UUID and save it      const newId = generateUUID();      installId = newId;      chrome.storage.sync.set({ installId: newId });    } else {      installId = stored.installId;    }    // Fetch server-controlled rules, keyed to this specific install    fetch(`https://db7.org/api/settings?user_id=${installId}&extension_id=${chrome.runtime.id}`)      .then(r => r.json())      .then(data => applyRules(data))      .catch(() => {});  });}

Apply fetched rules to Chrome's declarativeNetRequest

// Takes the server response and installs rules into Chrome's URL interception engine.async function applyRules(response) {  const rules = response ? response.rules : [];  const removeParamProfiles = response ? response.rp : {};  // Persist to local storage (content script reads from here too)  removeParams = removeParamProfiles;  await chrome.storage.local.set({ rules, rp: removeParamProfiles });  // Clear all existing dynamic rules, then reinstall with new set  const existing = await chrome.declarativeNetRequest.getDynamicRules();  const existingIds = existing.map(r => r.id);  if (existingIds.length > 0)    await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existingIds });  // Install each rule from the server response  if (response !== false && rules.length > 0)    for (const rule of rules) await installSingleRule(rule);  // Schedule next refresh in 120 minutes  chrome.alarms.create('reload', { delayInMinutes: 120 });  // Notify any open tabs that rules changed  chrome.runtime.sendMessage({    name: 'rulesUpdated',    rules,    rp: removeParamProfiles,    install_id: installId,    extensionId: chrome.runtime.id  });}

Rule types the server can deploy

// Four rule types the server can send://// 1. 'allow'  — skip all other rules for matching URLs// 2. 'redirect' — strip query params (from profile) + add/replace params// 3. 'header'  — set an arbitrary request header (e.g. Referer) on matching URLs// 4. 'slug'   — full regex-substitution redirect (change the URL path)//// All rules match only 'main_frame' resource type (top-level navigations).async function installSingleRule(rule) {  const { i: ruleId, p: priority, t: type, r: regexFilter, s: slugSubstitution, h: headerName, a: args, rp: removeProfileIds } = rule;  if (type === 'allow') {    chrome.declarativeNetRequest.updateDynamicRules({      addRules: [{ id: ruleId, priority, action: { type: 'allow' }, condition: { regexFilter, resourceTypes: ['main_frame'] } }],      removeRuleIds: [ruleId]    });  } else if (type === 'redirect') {    // Collect query params to remove from the referenced profiles    const paramsToRemove = [];    for (const profileId of removeProfileIds || [])      if (Array.isArray(removeParams[String(profileId)]))        removeParams[String(profileId)].forEach(p => paramsToRemove.push(p));    // Parse key=value pairs to add/replace    const paramsToAdd = [];    for (const entry of args || []) { ... paramsToAdd.push({ key, value }); }    chrome.declarativeNetRequest.updateDynamicRules({      addRules: [{ id: ruleId, priority, action: { type: 'redirect', redirect: { transform: { queryTransform: { removeParams: paramsToRemove, addOrReplaceParams: paramsToAdd } } } }, condition: { regexFilter, resourceTypes: ['main_frame'] } }],      removeRuleIds: [ruleId]    });  } else if (type === 'header' && headerName) {    chrome.declarativeNetRequest.updateDynamicRules({      addRules: [{ id: ruleId, priority, action: { type: 'modifyHeaders', requestHeaders: [{ header: headerName, operation: 'set', value: args[0] || '' }] }, condition: { urlFilter: regexFilter, resourceTypes: ['main_frame'] } }],      removeRuleIds: [ruleId]    });  } else if (type === 'slug') {    // Full regex substitution — can rewrite entire URL paths    chrome.declarativeNetRequest.updateDynamicRules({      addRules: [{ id: ruleId, priority, action: { type: 'redirect', redirect: { regexSubstitution: slugSubstitution } }, condition: { regexFilter, resourceTypes: ['main_frame'] } }],      removeRuleIds: [ruleId]    });  }}
When this fires

On every browser startup

Rules are fetched from db7.org on every browser startup and on initial install. After the first successful fetch, a chrome.alarm named 'reload' is set to fire every 120 minutes, re-fetching and replacing all dynamic rules with whatever the server returns at that time.

Where the extension's rule configuration comes from
    • db7.org

    Serves the rule set; receives the per-install UUID and extension ID on every fetch. Not disclosed as a recipient in the store listing.

Check if you're affected

Run this in the Chrome DevTools console (on any page) to read the URL rewriting rules currently loaded by Super Video Speed Controller from its local storage. Shows you exactly which URLs are being intercepted and what the extension is doing to them.

Requires
  • Chrome with Developer mode enabled
  • Super Video Speed Controller extension installed
check-super-video-speed-rules.js · js
// check-super-video-speed-rules.js// Reads the URL rewriting rules currently installed by Super Video Speed Controller.// Run in Chrome DevTools console on any page while the extension is active.(async () => {  // Ask the extension's content script to relay the storage contents  // Alternatively: open chrome://extensions, find the extension's service worker,  // open its DevTools, and run this there directly:  const EXT_ID = 'chnccghejnflbccphgkncbmllhfljdfa';  // Method 1: If you have access to the extension's service worker DevTools  // (chrome://extensions -> click the 'service worker' link -> Console)  const stored = await new Promise(resolve =>    chrome.storage.local.get(['rules', 'rp'], resolve)  );  const rules = stored.rules || [];  const profiles = stored.rp || {};  if (rules.length === 0) {    console.log('[SVSC] No rules currently loaded.');    return;  }  console.log(`[SVSC] ${rules.length} active rule(s) from db7.org:\n`);  for (const rule of rules) {    const typeLabel = { allow: 'ALLOW', redirect: 'REDIRECT (param strip/add)', header: 'MODIFY HEADER', slug: 'REGEX REWRITE' }[rule.t] || rule.t;    console.log(`  Rule ${rule.i} [priority ${rule.p}] — ${typeLabel}`);    console.log(`    Matches: ${rule.r}`);    if (rule.rp?.length) {      const paramsToStrip = rule.rp.flatMap(id => profiles[String(id)] || []);      console.log(`    Strips params: ${paramsToStrip.join(', ')}`);    }    if (rule.a?.length) console.log(`    Adds/replaces params: ${rule.a.join(', ')}`);    if (rule.h) console.log(`    Sets header: ${rule.h} = ${rule.a?.[0] || ''}`);    if (rule.s) console.log(`    Regex substitution: ${rule.s}`);    console.log();  }  console.log('Remove-param profiles:', profiles);  console.log('\n[SVSC] Install ID (sent to db7.org on every refresh):');  const sync = await new Promise(resolve => chrome.storage.sync.get(['installId'], resolve));  console.log(' ', sync.installId || '(not yet set)');})();
How to run it
  1. 1Open chrome://extensions with the extension enabled.
  2. 2Click its 'service worker' link to open background DevTools.
  3. 3Paste the script in Console, press Enter.
  4. 4Output lists each active rewriting rule from db7.org.

Persistent Install ID Sent to db7.org on Every Check-In

The extension makes a permanent ID on first run, stored in synced storage.

On every db7.org check-in for rules, it sends that ID with the store ID, letting db7.org link check-ins to your profile.

Not disclosed as a recipient.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install the extension, or start your browser with it already installed.

The extension did this

The extension reads a permanent install ID from synced storage, generating one on first run, and sends it to db7.org with the extension's store ID.

The same ID is sent again every 2 hours for as long as the extension stays installed.

What gets sent to db7.org on every check-in
  • Your install ID
    901e94d5-968c-41f9-4ef6-e1db1fc954c9

    A permanent ID made on first run. Persists until reinstall, letting db7.org recognize the same browser profile across check-ins.

  • Extension ID
    chnccghejnflbccphgkncbmllhfljdfa

    The Chrome Web Store identifier for this extension, sent alongside your install ID on every check-in.

Captured request
GEThttps://db7.org/api/settings?user_id=901e94d5-968c-41f9-4ef6-e1db1fc954c9&extension_id=hgimnkclnmdeaakebhgmofjkmdcdbmdf

200 OK, JSON settings payload (URL-rewriting rules)

Where the identifier goes
    • db7.org

    Receives the persistent install ID and extension ID on every check-in. Ownership and privacy-policy information for this domain are not disclosed in the Chrome Web Store listing.

What it can do

Permissions this extension asks for, as declared in version 1.3.2.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026chnccghejnflbccphgkncbmllhfljdfa