Is Video Downloader safe?

Video Downloader's content script has an unguarded message handler that sends the current URL and accepts DOM injection from any origin.

The extension registers a window.addEventListener('message', ...) handler in common.js without checking event.origin, and injects it on every page (*://*/*). When any web page sends a message with _m='url', the handler replies with the current page URL base64-encoded back to the sender. When the message carries _m='element', the handler appends an arbitrary HTML element — including any attributes — to the page DOM, which any web origin can trigger.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.