Is Telegram Video Downloader safe?

Medium risk

Telegram Video Downloader sends Telegram chat names to Google Analytics when users download videos.

When a user clicks its download button on web.telegram.org, the content script reads the active chat name from the page and passes it to the background script. The background script posts Google Analytics events for requested and completed video downloads with the chat name, page version, locale, and a persistent client ID.

builderproductv0.0.7Chrome Web Store
47Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Telegram chat names are sent to Google Analytics during media downloads

Downloading media in Telegram Web makes the extension read the active chat name and send it to Google Analytics.

The request is tied to a stored client ID and includes page context, associating the download with a specific chat label.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You download media from a Telegram Web chat.

The extension did this

The extension reads the active chat name and sends it in a Google Analytics event.

Captured request
POSTwww.google-analytics.com/mp/collect
Fields in the request
  • Active chat name
    Family group chat (illustrative)

    Identifies the Telegram conversation label visible when the download begins.

  • Stored analytics client ID
    client-id-abc123 (illustrative)

    Lets repeated extension events be associated with the same browser profile.

  • Telegram Web page URL
    https://web.telegram.org/k/ (illustrative)

    Provides context that the event came from Telegram Web during the download flow.

Observation

Dynamic analysis confirmed that the Telegram Web content script reads the chat name during the download flow and that the background handler posts the event to Google Analytics.

What it can do

Permissions this extension asks for, as declared in version 0.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Telegram Video Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Telegram Video Downloader sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026bbjnnajeogkkmljfdoengamaiomfhbch