Is VKSaver safe?

Question

Is VKSaver safe?

Accepted Answer

VKSaver is medium risk. Starting in version 5.27.0, VKSaver removes the Content-Security-Policy (CSP) header from vk.com pages as they load, without presenting any notification or consent prompt. CSP is a browser security mechanism that limits which scripts and resources can run on a page; removing it makes the page more susceptible to cross-site scripting (XSS) attacks that could inject unauthorized content or access your VK session. The extension's declarative network request ruleset applies this change automatically on every vk.com page load. The approximately 500,000 users of this extension have this protection disabled on vk.com unconditionally; vk.ru and vkvideo.ru are also affected if you previously granted the extension optional access to those domains.

Is VKSaver - скачать музыку ВК safe?

Findings