Is video downloader safe?
The extension fetches remote config from GitHub daily and runs scripts in every open browser tab on a remotely controlled schedule.
On each YouTube page visit, the extension transmits the page URL to vidow.me to retrieve video metadata. Every 24 hours it downloads a JSON config file from vdrt-chromium.github.io and stores its contents directly into local storage without integrity checks; this config controls how often the extension runs scripts across all open tabs. A periodic alarm — whose firing interval is set by that remote config — causes the extension to call chrome.scripting.executeScript on every tab the browser has open, regardless of the tab's origin.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Periodic Script Runs Across All Open Tabs
The service worker queries all open tabs on a periodic health-check alarm, then runs a script reading page navigation timing.
The interval is stored locally, refreshed remotely; broad permissions run it on pages regardless of site.
What actually happens
A repeating health-check alarm fires while the browser is open.
Dynamic analysis observed the tab query at 19:05:18 and again at 19:06:18.
The extension asks Chrome for every open tab and runs a timing script inside tabs with ids.
The observed follow-up call executed the script on tab 1585209811.
When this fires
Every 1 minute
The health-check alarm repeats once per minute by default, and the interval can be changed by configuration stored in the extension.
Fields accessed during the periodic tab check
- Open tab id1585209811
Lets the extension choose which open page receives the timing script.
- Page start time1720811118123
Shows when the page began loading in your browser.
- Page finish time1720811119468
Shows when the page load event finished in your browser.
- Calculated load time1345 ms
Turns the two timing values into a page-load duration for that tab.
Captured request
JSON configuration includes updateHealthCheckPeriod: 1
The code that does this
Alarm handler that queries every tab and executes the timing function
function f(e) { chrome.alarms.create("healthCheck", { periodInMinutes: e })}chrome.alarms.create("fetchUrlPatterns", { periodInMinutes: 1440}), chrome.alarms.onAlarm.addListener((e => { "healthCheck" === e.name && async function() { const e = () => { let e = window.performance.timing.navigationStart, t = window.performance.timing.loadEventEnd; return { startTime: e, endTime: t, loadTime: t - e } }; (await chrome.tabs.query({})).forEach((async t => { if (t.id) try { await chrome.scripting.executeScript({ target: { tabId: t.id }, func: e }) } catch (t) {} })) }(), "fetchUrlPatterns" === e.name && async function() { try { const e = await fetch(b), t = await e.json(); chrome.storage.local.set(t) } catch (e) { console.error("Failed to fetch URL patterns:", e) } }()})), chrome.storage.onChanged.addListener((e => { if (e.patterns) { p(e.urlPatterns.newValue.values()) } if (e.updateHealthCheckPeriod) { f(e.updateHealthCheckPeriod.newValue) }})), chrome.storage.local.get((e => { if (e.patterns) { const t = e.patterns.values(); t && p(t) } e.updateHealthCheckPeriod ? f(e.updateHealthCheckPeriod) : f(1)}))External host used to refresh the scripting cadence
- vdrt-chromium.github.io
Hosts the JSON configuration file that includes URL patterns and the updateHealthCheckPeriod value used by the service worker.
What it can do
Permissions this extension asks for, as declared in version 2.7.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Watch every request your browser makes
webRequest
See the address and title of every tab you have open
tabs
Start, monitor and manage your downloads
downloads
Run its own code inside the pages you visit
scripting
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed video downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- vdrt-chromium.github.io
video downloader sends data to vdrt-chromium.github.io. No other extension we have analyzed sends data here.
- vidow.me
video downloader sends data to vidow.me. No other extension we have analyzed sends data here.