Is Video Downloader safe?
Video Downloader's content script has an unguarded message handler that sends the current URL and accepts DOM injection from any origin.
The extension registers a window.addEventListener('message', ...) handler in common.js without checking event.origin, and injects it on every page (*://*/*). When any web page sends a message with _m='url', the handler replies with the current page URL base64-encoded back to the sender. When the message carries _m='element', the handler appends an arbitrary HTML element — including any attributes — to the page DOM, which any web origin can trigger.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on youtube.com
*://*.youtube.com/*
Read and change your data on twitter.com
*://*.twitter.com/*
Read and change your data on every site you visit
https://*/pin/*
Read and change your data on reddit.com
*://*.reddit.com/*
Read and change your data on soundcloud.com
*://soundcloud.com/*
Read and change your data on twitch.tv
*://twitch.tv/*
Read and change your data on vimeo.com
*://*.vimeo.com/*
Read and change your data on tiktok.com
*://*.tiktok.com/*
See every page you navigate to, as you navigate to it
webNavigation
Watch every request your browser makes
webRequest
Store data in your browser
storage