"; iframe.width = \"100%\"; iframe.height = \"850px\"; iframe.src = 'https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init'; iframe.style.cssText = ''; img = document.getElementById('winfyin'); img.parentNode.insertBefore(iframe, img); img.parentNode.removeChild(img); img = document.getElementById('winfyin'); } }); }","caption":"Run VLC onclick handler (js/index.js lines 304–343)","sourceFile":"js/index.js"}],"language":"js","deobfuscated":[{"code":"// When user clicks 'Run VLC': // 1. Show a confirmation dialog // 2. If confirmed, hide the local UI (preframex) and show the remote iframe container (winfyout) // 3. Create a new ","before":"

VLC Online

","change":"The local button UI is removed from view and the full popup area is replaced by a live iframe loading remote server content from winfy.net.","target":"extension popup (start.html #page1)","technicalNote":"start.html lines 62–92 define the two containers. js/index.js lines 319-320 toggle their display; lines 322-333 create and insert the live iframe."},{"kind":"field_table","fields":[{"icon":"tag","label":"OS identifier","meaning":"Identifies the operating system and distribution variant associated with this extension build.","severity":"context","sampleValue":"winfy-vlc-22.04.3-desktop-amd64"},{"icon":"navigation","label":"Load mode","meaning":"Tells the winfy.net server which page variant to deliver into the popup iframe.","severity":"context","sampleValue":"init"}],"caption":"URL parameters sent to winfy.net on every popup activation","technicalNote":"Full URL: https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init — hardcoded in js/index.js lines 280 and 326."},{"body":"The popup page (`start.html` line 4) sets `Content-Security-Policy: default-src *; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'`. This allows the winfy.net server to deliver scripts via any HTTP URL, execute inline JavaScript, and call `eval()` inside the extension popup. No Chrome extension API access is granted to the iframe itself, but the popup page's own script context operates under these relaxed rules.","kind":"plain_note","title":"Permissive Content Security Policy"},{"kind":"third_party_list","hosts":[{"host":"www.winfy.net","purpose":"Hosts all functionality shown in the extension popup via a WordPress-based page. Delivers the popup UI and executes scripts in the extension popup context. Ownership and data handling practices are not disclosed in the Chrome Web Store listing."}],"caption":"Remote host receiving requests from the extension popup"}],"scaleMetrics":[{"fill":0.6,"tier":"warning","label":"Trigger","value_label":"One click + confirm"},{"fill":1,"tier":"error","label":"Local functionality","value_label":"None — fully remote"},{"fill":1,"tier":"error","label":"CSP restriction","value_label":"None for remote HTTP"},{"fill":0.5,"tier":"warning","label":"Server-controlled scripts loaded","value_label":"3 observed"}],"trustTier":"ai-sandbox","userActions":[]},"variant":"inline","expectedKind":"unexpected","showVerificationBadge":false}]]}]],false]}]]

Is VLC online - multimedia player safe?

Findings