Is video downloader safe?
The extension fetches remote config from GitHub daily and runs scripts in every open browser tab on a remotely controlled schedule.
On each YouTube page visit, the extension transmits the page URL to vidow.me to retrieve video metadata. Every 24 hours it downloads a JSON config file from vdrt-chromium.github.io and stores its contents directly into local storage without integrity checks; this config controls how often the extension runs scripts across all open tabs. A periodic alarm — whose firing interval is set by that remote config — causes the extension to call chrome.scripting.executeScript on every tab the browser has open, regardless of the tab's origin.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Periodic Script Runs Across All Open Tabs
The service worker queries all open tabs on a periodic health-check alarm, then runs a script reading page navigation timing.
The interval is stored locally, refreshed remotely; broad permissions run it on pages regardless of site.
A repeating health-check alarm fires while the browser is open.
Dynamic analysis observed the tab query at 19:05:18 and again at 19:06:18.
The extension asks Chrome for every open tab and runs a timing script inside tabs with ids.
The observed follow-up call executed the script on tab 1585209811.
The health-check alarm repeats once per minute by default, and the interval can be changed by configuration stored in the extension.
| Field | Value | Why it matters | |
|---|---|---|---|
Open tab id | 1585209811 | Lets the extension choose which open page receives the timing script. | |
Page start time | 1720811118123 | Shows when the page began loading in your browser. | |
Page finish time | 1720811119468 | Shows when the page load event finished in your browser. | |
Calculated load time | 1345 ms | Turns the two timing values into a page-load duration for that tab. |
Alarm handler that queries every tab and executes the timing function
function f(e) {
chrome.alarms.create("healthCheck", {
periodInMinutes: e
})
}
chrome.alarms.create("fetchUrlPatterns", {
periodInMinutes: 1440
}), chrome.alarms.onAlarm.addListener((e => {
"healthCheck" === e.name && async function() {
const e = () => {
let e = window.performance.timing.navigationStart,
t = window.performance.timing.loadEventEnd;
return {
startTime: e,
endTime: t,
loadTime: t - e
}
};
(await chrome.tabs.query({})).forEach((async t => {
if (t.id) try {
await chrome.scripting.executeScript({
target: {
tabId: t.id
},
func: e
})
} catch (t) {}
}))
}(), "fetchUrlPatterns" === e.name && async function() {
try {
const e = await fetch(b),
t = await e.json();
chrome.storage.local.set(t)
} catch (e) {
console.error("Failed to fetch URL patterns:", e)
}
}()
})), chrome.storage.onChanged.addListener((e => {
if (e.patterns) {
p(e.urlPatterns.newValue.values())
}
if (e.updateHealthCheckPeriod) {
f(e.updateHealthCheckPeriod.newValue)
}
})), chrome.storage.local.get((e => {
if (e.patterns) {
const t = e.patterns.values();
t && p(t)
}
e.updateHealthCheckPeriod ? f(e.updateHealthCheckPeriod) : f(1)
}))- vdrt-chromium.github.io
Hosts the JSON configuration file that includes URL patterns and the updateHealthCheckPeriod value used by the service worker.