Is Video Speed Controller - Universal Video Playback Speed safe?

Medium risk

Video Speed Controller bundles the Mellowtel SDK, which after opt-in loads server-chosen pages using your browser.

After you accept a consent dialog, the extension connects to ws.mellow.tel and receives page URLs to load in a hidden frame with your browser's cookies. It strips security headers such as X-Frame-Options and CSP for those loads, then sends the page HTML or Markdown back to a server-supplied URL. It can act on any site because it requests access to all URLs.

siegeappbrasilv1.0.4Chrome Web Store
49Risk
Who publishes it

siegeappbrasil - 11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
siegeappbrasil

Same store account

11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.

Clock, Alarm, Timer & Stopwatch692MediumImage Downloader Assistant - Batch Save Images337MediumUndo Closed Tabs – Reopen Last Tab236MediumAlarm, Timer & Stopwatch for Browser230MediumQR Code Generator & Reader69MediumMonitix – Stock & Crypto Price Alert & Tracker41Medium5 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

docs.mellowtel.com
Also called by 1 other listing: Edit Anything
endpoint-example.com
Also called by 1 other listing: Edit Anything

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Mellowtel SDK loads server-chosen pages with your cookies and returns content

Code analysis shows that after opt-in, the bundled Mellowtel SDK connects to ws.mellow.tel, loads URLs the server chooses with security headers removed, and posts the page HTML to a server-supplied URL.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You click Accept on the Mellowtel dialog in the extension popup.

The extension stores mellowtelOptIn=true and starts the SDK.

The extension did this

The extension connects to ws.mellow.tel and loads whatever pages the server requests.

Page content is posted back to a server-supplied URL.

The code that does this

Header stripping and endpoint constants in background.js

Readable version

WebSocket endpoint

background.js
Fi = "wss://ws.mellow.tel", yi = [3e4, 6e4, 3e5, 6e5, 12e5, 36e5], Ei = !1, vi = 0

Session rule removing response headers

background.js
chrome.declarativeNetRequest.updateSessionRules({  removeRuleIds: [n],  addRules: [{    id: n,    priority: 1,    action: {      type: "modifyHeaders",      responseHeaders: [{        header: "x-frame-options",        operation: "remove"      }, {        header: "content-security-policy",        operation: "remove"      }, {        header: "cross-origin-embedder-policy",        operation: "remove"      }, {        header: "cross-origin-opener-policy",        operation: "remove"      }]    }
Job parameters the SDK honours
  • Job URL
    Server-supplied (illustrative: https://example.com/account)

    The page the server tells the extension to load.

  • Browser session
    Cookies for the job URL's origin

    Requests are made from your browser, so site cookies apply.

  • saveHtml / saveMarkdown
    saveHtml: true

    Flags selecting whether HTML and Markdown are returned.

  • method_endpoint
    Server-supplied (illustrative)

    Server-supplied URL that receives the page content.

Hosts contacted by the SDK
    • ws.mellow.tel

    Mellowtel WebSocket that delivers crawl jobs to the extension.

    • mellowtel-bucket.s3.us-east-1.amazonaws.com

    Per-extension on/off switch file checked before connecting.

    • api.mellow.tel

    Mellowtel approval endpoint referenced by the SDK.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Video Speed Controller - Universal Video Playback Speed contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Video Speed Controller - Universal Video Playback Speed sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • Mellowtel

    Video Speed Controller - Universal Video Playback Speed sends data to Mellowtel. Named as a recipient by 2 other extensions we have analysed.

Updated 15 October 2026gmpgnedihbpapkkeafjehjnlgnghlmjd