Is Online video downloader - download video safe?
Download online videos for offline viewing from supported websites.
This extension detects media on websites and lets you save videos, clips, and other media types for offline access. It supports multiple simultaneous downloads, high-speed downloading, and use without account registration, according to the store description.
Who publishes itkonimatoan - 1 other listing from the same operator, 1 of them carrying a finding
konimatoan - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 50k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Video downloader extracts VK/VKVideo stream URLs; ships unused CORS-bypass rule
Opening a video on vk.com/vkvideo.ru sends the video ID to vkvideo.ru/al_video.php, returning the title and signed links at four qualities (240p-1080p).
It also ships an enabled rule letting vkvideo.ru read vk.com cross-origin, unused here.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open a video on vk.com or vkvideo.ru.
The content script's MutationObserver detects the vk-video-player element and reads the video ID from the page URL.
The extension sends the video ID to vkvideo.ru and receives back direct download links for the video at four quality levels.
We captured this request going to vkvideo.ru/al_video.php with the video ID in the POST body.
200 OK, JSON payload containing the video title and signed stream URLs at 240p/480p/720p/1080p.
- content-type
- application/x-www-form-urlencoded;charset=UTF-8
- x-requested-with
- XMLHttpRequest
act=show&al=1&video=-23482802_456273631- Video titleRick Astley - Never Gonna Give You Up
The title of the video you're viewing, used to name the downloaded file.
- Direct download URLs (4 qualities)https://vkvd625.mycdn.me/download/expires/1735689600/srcIp/1.2.3.4/video.mp4?extra=<signature> (illustrative)
Signed, time-limited download links for the video at 240p, 480p, 720p, and 1080p.
Video-ID extraction and stream-URL request in content.js (lines 12780-12797)
function scanForVideoPlayers() { // Reset the cached video list whenever the page URL changes if (window.location.href !== lastUrl) { lastUrl = window.location.href; videoList = []; updateBadge(0); $("*").removeClass(processedClass); } $("vk-video-player").not("." + processedClass).each(function (_, el) { const $el = $(el); // Extract the video ID (e.g. "-23482802_456273631") from the page URL const videoId = (function () { const path = window.location.pathname; if (!path.includes("video-")) return null; const m = path.match(/video(-?\d+_\d+)/); return m ? m[1] : null; })(); if (videoId) { $.ajax({ url: "https://vkvideo.ru/al_video.php?act=show", method: "POST", headers: { "x-requested-with": "XMLHttpRequest", "content-type": "application/x-www-form-urlencoded;charset=UTF-8" }, data: "act=show&al=1&video=" + videoId, success: function (response) { const player = response.payload[1][4].player.params[0]; const title = player.md_title; const streams = []; const isDigits = /^\d+$/; // Collect every "url<quality>" field (url240, url480, url720, url1080, ...) for (const key in player) { if (key.includes("url")) { const quality = key.slice(3); if (isDigits.test(quality)) streams.push({ url: player[key], quality }); } } streams.sort((a, b) => (+a.quality < +b.quality ? 1 : -1)); } }); $el.addClass(processedClass); } });}declarativeNetRequest rule id=3 in rules.json, rewrites the CORS header on vk.com API responses
// Rule id 3: for any XHR to vk.com/al_video.php, rewrite the response so it// carries Access-Control-Allow-Origin: https://vkvideo.ru — letting a script// running on the vkvideo.ru origin read the vk.com response body, which the// same-origin policy would otherwise block.{ "id": 3, "priority": 1, "action": { "type": "modifyHeaders", "responseHeaders": [ { "header": "Access-Control-Allow-Origin", "operation": "set", "value": "https://vkvideo.ru" } ] }, "condition": { "urlFilter": "https://vk.com/al_video.php*", "resourceTypes": ["xmlhttprequest"] }}Our dynamic-analysis session captured the video-stream-URL request originating from vkvideo.ru itself, because vk.com now performs a server-side redirect to vkvideo.ru before the page finishes loading — so the request stayed same-origin and never needed the CORS-bypass rule. The declarativeNetRequest rule that rewrites vk.com's CORS header for vkvideo.ru is still present and enabled in the shipped rules.json. Exercising it as an actual cross-origin bypass would require the request to originate directly from a vk.com-hosted page, which we did not observe in this session.
- vkvideo.ru
Receives the video ID and returns the video title plus direct, signed download URLs at multiple quality levels. Same platform as vk.com (VKontakte's video product).
Error telemetry sends current page URL and Referer to operator server
Bundled Sentry points to lola.ultimate-vdownloader.com, developer-run, not sentry.io.
On 'handleReject'/'handleLoad' errors, plus 20% of others, it sends page URL, Referer, User-Agent there.
Script runs everywhere; any tab can leak.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
An error occurs in the extension while you are on any page.
The service worker catches promise rejections (handleReject) and XHR load failures (handleLoad), plus a 20% random sample of all other errors.
The Sentry SDK packages the current page URL, Referer, and User-Agent into an error report and sends it to the developer's server.
The destination is lola.ultimate-vdownloader.com, a custom Sentry-compatible host run by the extension developer, not the public sentry.io service.
- Current page URLhttps://www.youtube.com/watch?v=dQw4w9WgXcQ
The full address of the tab you were on when the error fired, including any path or query parameters.
- Refererhttps://www.google.com/search?q=download+tiktok+video
The page you navigated from, which can reveal browsing patterns across sites.
- User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Your browser type, version, and operating system.
Sentry initialization in service_worker.js (lines 12233-12248)
eo({ dsn: "https://86e574d0b77a46b8a0921cbc431d48a2@lola.ultimate-vdownloader.com/63", release: chrome.runtime.getManifest().version, integrations: function(e) { return e.filter((function(e) { return "Breadcrumbs" !== e.name && "Dedupe" !== e.name; })); }, sampleRate: 1, beforeBreadcrumb: function() { return null; }, beforeSend: function(e) { // Send if message is handleReject or handleLoad, OR randomly 20% of other errors return "handleReject" === (null == e ? void 0 : e.message) || "handleLoad" === (null == e ? void 0 : e.message) || Math.random() < .2 ? e : null; }});- lola.ultimate-vdownloader.com
Operator-controlled Sentry-compatible error ingestion endpoint (project ID 63). Not the public sentry.io service, hosted on the developer's own infrastructure.
What it can do
Permissions this extension asks for, as declared in version 1.4.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Start, monitor and manage your downloads
downloads
Store data in your browser
storage
Watch every request your browser makes
webRequest
Block and redirect the requests your browser makes
declarativeNetRequest