Is Video Downloader for U safe?

Medium risk

Video Downloader for U is medium risk. On Twitter/X while logged in, the extension reads your ct0 CSRF cookie and sends it to its worker, which combines it with a hardcoded Bearer token for Twitter API calls. This runs on every video lookup; ct0 goes out to api.twitter.com.

VideoUnitv1.1.4Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Twitter/X session token forwarded to authenticated API requests

On Twitter/X while logged in, the extension reads your ct0 CSRF cookie and sends it to its worker, which combines it with a hardcoded Bearer token for Twitter API calls.

This runs on every video lookup; ct0 goes out to api.twitter.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You browse a Twitter/X page that contains a video while logged into your Twitter account.

The extension did this

The extension reads your ct0 CSRF session cookie and passes it to the background service worker, which sends it as a request header in an authenticated call to api.twitter.com.

The ct0 cookie is a CSRF token Twitter uses to authenticate in-session API requests. The extension uses it as if it were operating on your behalf.

The code that does this

Cookie extraction and relay to background (content.js)

Readable version
// content.js:3878this.isCookiesSent || (r.x_csrf_token = this.getCookie('ct0'));chrome.runtime.sendMessage({  message: 'get-twitter-link',  requestData: r   // r = { tweetId, x_csrf_token: <ct0 value> }}, function(e) { ... });
Captured request
GEThttps://api.twitter.com/2/timeline/conversation/1234567890123456789.json?include_profile_interstitial_type=1&include_blocking=1&tweet_mode=extended&count=20&ext=mediaStats

Twitter conversation JSON containing tweet metadata and video variant URLs; used to extract the video download link.

Headers
x-csrf-token
<user's ct0 session token>
Authorization
Bearer AAAAAAAAAAAAAAAAAAAAAPYXBAAAAAAACLXUNDekMxqa8h%2F40K4moUkGsoc%3DTYfbDKbT3jJPCEVnMYqilB28NHfOPqkca3qaAxGfsyKCs0wRbw
Why you can't catch this in DevTools

The extension ships a Base64-encoded string in content.js that is the developer's Twitter OAuth2 app client_id:client_secret pair, used to obtain app-level Bearer tokens via the client_credentials flow.

Decoded value
PKKiu9IjEESHTRUsrjnHuc0Cl:soYL1fNkpCNlKp5MGH5BJFwOJ840zIbXeV0w8zqaQpQLN2E2YH
Data read from the user's browser and forwarded to Twitter API
  • Twitter/X session CSRF token
    a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

    This cookie authenticates API requests as your account. Any service receiving it can make Twitter API calls on your behalf for your session.

Reproduce it yourself

Decodes the hardcoded Base64 OAuth2 app credential from the extension source to confirm the client_id:client_secret pair, and illustrates the request shape the background worker sends.

Requires
  • Node.js 14+
check-twitter-cookie-relay.js · js
// Reproducer: verify the hardcoded Twitter OAuth2 credential and the API call shape// Run in Node.js — no network calls made.const ENCODED = 'UEtLaXU5SWpFRVNIVFJVc3Jqbkh1YzBDbDpzb1lMMWZOa3BDTmxLcDVNR0g1QkpGd09KODQwekliWGVWMHc4enFhUXBRTE4yRTJZSA==';const BEARER  = 'AAAAAAAAAAAAAAAAAAAAAPYXBAAAAAAACLXUNDekMxqa8h%2F40K4moUkGsoc%3DTYfbDKbT3jJPCEVnMYqilB28NHfOPqkca3qaAxGfsyKCs0wRbw';const decoded = Buffer.from(ENCODED, 'base64').toString('utf8');console.log('Decoded app credential:', decoded);const [clientId, clientSecret] = decoded.split(':');console.log('client_id    :', clientId);console.log('client_secret:', clientSecret);const exampleTweetId = '1234567890123456789';const exampleCt0     = 'YOUR_CT0_COOKIE_VALUE_HERE';console.log('\nSimulated API request shape:');console.log('GET', `https://api.twitter.com/2/timeline/conversation/${exampleTweetId}.json?tweet_mode=extended&count=20`);console.log('Headers:');console.log('  Authorization:', `Bearer ${BEARER}`);console.log('  x-csrf-token:', exampleCt0);console.log('\n(x-csrf-token is read from the visiting user\'s ct0 browser cookie)');
How to run it
  1. 1Save the file as check-twitter-cookie-relay.js.
  2. 2Run: node check-twitter-cookie-relay.js.
  3. 3Confirm the decoded client_id and client_secret match values above.

What it can do

Permissions this extension asks for, as declared in version 1.1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Start, monitor and manage your downloads

    downloads

  • Watch every request your browser makes

    webRequest

Updated 30 September 2026dkbccihpiccbcheieabdbjikohfdfaje