Is Online video downloader - download video safe?

Medium risk

Download online videos for offline viewing from supported websites.

This extension detects media on websites and lets you save videos, clips, and other media types for offline access. It supports multiple simultaneous downloads, high-speed downloading, and use without account registration, according to the store description.

konimatoanv1.4.2Chrome Web Store
52Risk
Who publishes it

konimatoan - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
konimatoan

Same store account

1 other listing published from this account, 50k+ users between them. 1 of them carries a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Video downloader extracts VK/VKVideo stream URLs; ships unused CORS-bypass rule

Opening a video on vk.com/vkvideo.ru sends the video ID to vkvideo.ru/al_video.php, returning the title and signed links at four qualities (240p-1080p).

It also ships an enabled rule letting vkvideo.ru read vk.com cross-origin, unused here.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open a video on vk.com or vkvideo.ru.

The content script's MutationObserver detects the vk-video-player element and reads the video ID from the page URL.

The extension did this

The extension sends the video ID to vkvideo.ru and receives back direct download links for the video at four quality levels.

We captured this request going to vkvideo.ru/al_video.php with the video ID in the POST body.

Captured request
POSThttps://vkvideo.ru/al_video.php?act=show

200 OK, JSON payload containing the video title and signed stream URLs at 240p/480p/720p/1080p.

Headers
content-type
application/x-www-form-urlencoded;charset=UTF-8
x-requested-with
XMLHttpRequest
Body
act=show&al=1&video=-23482802_456273631
Fields returned by vkvideo.ru/al_video.php
  • Video title
    Rick Astley - Never Gonna Give You Up

    The title of the video you're viewing, used to name the downloaded file.

  • Direct download URLs (4 qualities)
    https://vkvd625.mycdn.me/download/expires/1735689600/srcIp/1.2.3.4/video.mp4?extra=<signature> (illustrative)

    Signed, time-limited download links for the video at 240p, 480p, 720p, and 1080p.

The code that does this

Video-ID extraction and stream-URL request in content.js (lines 12780-12797)

Readable version
function scanForVideoPlayers() {  // Reset the cached video list whenever the page URL changes  if (window.location.href !== lastUrl) {    lastUrl = window.location.href;    videoList = [];    updateBadge(0);    $("*").removeClass(processedClass);  }  $("vk-video-player").not("." + processedClass).each(function (_, el) {    const $el = $(el);    // Extract the video ID (e.g. "-23482802_456273631") from the page URL    const videoId = (function () {      const path = window.location.pathname;      if (!path.includes("video-")) return null;      const m = path.match(/video(-?\d+_\d+)/);      return m ? m[1] : null;    })();    if (videoId) {      $.ajax({        url: "https://vkvideo.ru/al_video.php?act=show",        method: "POST",        headers: {          "x-requested-with": "XMLHttpRequest",          "content-type": "application/x-www-form-urlencoded;charset=UTF-8"        },        data: "act=show&al=1&video=" + videoId,        success: function (response) {          const player = response.payload[1][4].player.params[0];          const title = player.md_title;          const streams = [];          const isDigits = /^\d+$/;          // Collect every "url<quality>" field (url240, url480, url720, url1080, ...)          for (const key in player) {            if (key.includes("url")) {              const quality = key.slice(3);              if (isDigits.test(quality)) streams.push({ url: player[key], quality });            }          }          streams.sort((a, b) => (+a.quality < +b.quality ? 1 : -1));        }      });      $el.addClass(processedClass);    }  });}
The code that does this

declarativeNetRequest rule id=3 in rules.json, rewrites the CORS header on vk.com API responses

Readable version
// Rule id 3: for any XHR to vk.com/al_video.php, rewrite the response so it// carries Access-Control-Allow-Origin: https://vkvideo.ru — letting a script// running on the vkvideo.ru origin read the vk.com response body, which the// same-origin policy would otherwise block.{  "id": 3,  "priority": 1,  "action": {    "type": "modifyHeaders",    "responseHeaders": [      {        "header": "Access-Control-Allow-Origin",        "operation": "set",        "value": "https://vkvideo.ru"      }    ]  },  "condition": {    "urlFilter": "https://vk.com/al_video.php*",    "resourceTypes": ["xmlhttprequest"]  }}
What we observed vs. what the code enables

Our dynamic-analysis session captured the video-stream-URL request originating from vkvideo.ru itself, because vk.com now performs a server-side redirect to vkvideo.ru before the page finishes loading — so the request stayed same-origin and never needed the CORS-bypass rule. The declarativeNetRequest rule that rewrites vk.com's CORS header for vkvideo.ru is still present and enabled in the shipped rules.json. Exercising it as an actual cross-origin bypass would require the request to originate directly from a vk.com-hosted page, which we did not observe in this session.

Video-data destination
    • vkvideo.ru

    Receives the video ID and returns the video title plus direct, signed download URLs at multiple quality levels. Same platform as vk.com (VKontakte's video product).

Error telemetry sends current page URL and Referer to operator server

Bundled Sentry points to lola.ultimate-vdownloader.com, developer-run, not sentry.io.

On 'handleReject'/'handleLoad' errors, plus 20% of others, it sends page URL, Referer, User-Agent there.

Script runs everywhere; any tab can leak.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

An error occurs in the extension while you are on any page.

The service worker catches promise rejections (handleReject) and XHR load failures (handleLoad), plus a 20% random sample of all other errors.

The extension did this

The Sentry SDK packages the current page URL, Referer, and User-Agent into an error report and sends it to the developer's server.

The destination is lola.ultimate-vdownloader.com, a custom Sentry-compatible host run by the extension developer, not the public sentry.io service.

Fields attached to each telemetry event (HttpContext integration)
  • Current page URL
    https://www.youtube.com/watch?v=dQw4w9WgXcQ

    The full address of the tab you were on when the error fired, including any path or query parameters.

  • Referer
    https://www.google.com/search?q=download+tiktok+video

    The page you navigated from, which can reveal browsing patterns across sites.

  • User-Agent
    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

    Your browser type, version, and operating system.

The code that does this

Sentry initialization in service_worker.js (lines 12233-12248)

Readable version
eo({  dsn: "https://86e574d0b77a46b8a0921cbc431d48a2@lola.ultimate-vdownloader.com/63",  release: chrome.runtime.getManifest().version,  integrations: function(e) {    return e.filter((function(e) {      return "Breadcrumbs" !== e.name && "Dedupe" !== e.name;    }));  },  sampleRate: 1,  beforeBreadcrumb: function() {    return null;  },  beforeSend: function(e) {    // Send if message is handleReject or handleLoad, OR randomly 20% of other errors    return "handleReject" === (null == e ? void 0 : e.message)      || "handleLoad" === (null == e ? void 0 : e.message)      || Math.random() < .2        ? e        : null;  }});
Error telemetry destination
    • lola.ultimate-vdownloader.com

    Operator-controlled Sentry-compatible error ingestion endpoint (project ID 63). Not the public sentry.io service, hosted on the developer's own infrastructure.

What it can do

Permissions this extension asks for, as declared in version 1.4.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

  • Watch every request your browser makes

    webRequest

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026ledkggjjapdgojgihnaploncccgiadhg