Is Video Downloader - Video Hunter safe?
Video Hunter Downloader collects your IP address and geolocation profile at startup and sends browsing activity to Google Analytics on every download and popup interaction.
On startup, the extension fetches your public IP address and geolocation data (including ISP, coordinates, city, and timezone) from ip-api.com and stores it locally. This profile is bundled into analytics events — covering every download, page view, and popup action — and transmitted to Google Analytics via the Measurement Protocol. The extension also fetches its configuration remotely from data.getvideohunter.com, which can supply a URL to dynamically replace the list of sites the extension monitors and intercepts.
Who publishes itVideo Hunter - no other listings under this identity, 1 shared hostname
Video Hunter - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote config controls which sites Video Hunter processes
On every startup, Video Hunter fetches a config file from data.getvideohunter.com.
A blockerUrl field, when present, points to a blocking-rules list that replaces the built-in intercept list, changeable anytime without a Web Store update.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open Chrome with Video Hunter installed.
The extension's background service worker starts automatically and initiates the configuration loading sequence.
The extension fetches a config file that can supply a second URL, then fetches that URL and replaces its built-in list of websites it will process.
The replacement occurs without a user notification, permission prompt, or extension update. The developer can expand the extension's processing scope to additional sites on demand.
{"analyticsId":"G-B7MGWELK9Q","analyticsSecret":"mJT_QebbRCasJ8sWvRULYQ","blockerUrl":"https://data.getvideohunter.com/chrome/blocker.json","siteUrl":"https://getvideohunter.com","welcomeUrl":"https://getvideohunter.com/welcome","silence":24}
{"Amazon":["*://*.amazon.com/*","*://amazon.com/*"],"Netflix":["*://*.netflix.com/*","*://netflix.com/*"],"Disney":["*://*.disneyplus.com/*","*://disneyplus.com/*"],"YouTube":["*://*.youtube.com/*","*://youtube.com/*"],"Facebook":["*://*.facebook.com/*"],"Twitter":["*://*.x.com/*"],"Instagram":["*://*.instagram.com/*"],"Google":["*://*.google.*/*"]}
initBlocker() fetches and applies the remote blocker list
// background.js:27708 — called on every startup after config.json is loadedasync initBlocker() { if (!this.config) throw new Error('Config not found'); const { blockerUrl } = this.config.get(); if (blockerUrl) { // Clears chrome.storage['blocker'], then fetches the remote URL // and replaces the active route list with the response await this.blocker.setUrlAndLoad(blockerUrl); }}// background.js:25398 — class za (Blocker).setUrlAndLoad()async setUrlAndLoad(url) { await clearStorage(this.storageKey); // wipes existing blocker list await this.setUrl(url).load(); // fetches remote URL, applies result}The extension fetches the blocker list JSON over HTTPS but performs no signature, hash, or version check on the response. The only validation applied is `validateBlockerList()` (background.js:25442), which checks that the response is a non-empty object whose values are arrays of strings — a structural check only. A compromised or modified server response could expand the set of sites the extension intercepts without any user-visible change.
Where it sends data
Destinations our analysis observed Video Hunter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Video Hunter sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- ip-api.comwidely used
Video Hunter sends data to ip-api.com. A widely used service: 62 other extensions we have analysed send data here.
- data.getvideohunter.com
Video Hunter sends data to data.getvideohunter.com. 2 other extensions we have analysed send data here.