Is VLC online - multimedia player safe?

Q: Who makes VLC online - multimedia player?

VLC online - multimedia player is published by Winfy, registered at Harju maakond, Tallinn, Kesklinna linnaosa, Viru väljak 2,, 2, Tallin 10111, EE. The same operator publishes 12 other store listings, 1 of which carry a security finding.

Medium risk

VLC online - multimedia player is medium risk. Listed as "VLC online - multimedia player" (VLC-style playback), the popup's "Run VLC" button replaces it with a Winfy RunWine iframe or page. We found no local media-player, codec, video, or audio code; it only loads the remote Winfy URL.…

Winfyv1.1.6Chrome Web Store

47Risk

Who publishes it

Winfy - 12 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Winfy

Declared legal entity

Winfy

Registered address

Harju maakond, Tallinn, Kesklinna linnaosa, Viru väljak 2,, 2, Tallin 10111, EE

Registered contact

Winfy

Website

www.winfy.net

Same store account

10 other listings published from this account, 19k+ users between them, none of them carrying a finding.

notepad++-online10k+Low Format Factory online4k+Clean Slither Candy game2k+Clean Wine online for Winapps1k+Clean Snake Candy game658Clean Workstation for Discord573Low 4 more listings in the relationship graph, on paid plans →

Same operator - 2 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

MyAndroid

same registered address

100k+High

Apache Cordova online CordovaIDE

same registered address

2k+Clean

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

winfy.net

Also called by 5 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

VLC-branded extension loads Winfy instead of local playback

MediumunwantedCWE-506Dynamic sandbox

Listed as "VLC online - multimedia player" (VLC-style playback), the popup's "Run VLC" button replaces it with a Winfy RunWine iframe or page.

What actually happens

You did this

You start the VLC-branded extension and choose "Run VLC."

The popup and side menu both present the action as starting VLC online.

The extension did this

The extension loads a remote Winfy RunWine page instead of running bundled media-player code.

The shipped handlers set an iframe to winfy.net or open a Winfy RunWine start page.

Concrete values present in the shipped extension

Extension name
VLC online - multimedia player
This is the name shown to you for the installed extension.
Extension description
Play most multimedia files, and various streaming protocols with this VLC distributed online.
This tells you the extension is for playing multimedia files and streaming protocols.
Iframe launch URL
https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init
This is the remote page the extension loads after you confirm the Run VLC action.
Full-screen launch URL
https://www.winfy.net/runwine/start.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init
This is the remote page opened by the popup menu's full-screen option.
Stored Winfy state
winfykeyx = { uxr: "k9p4m2q8va", wifyc: "1" }
The extension keeps a small local Winfy state record for later popup runs.

Captured request

GEThttps://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init

The shipped popup code sets this URL as an iframe source after the user confirms the Run VLC prompt; no request body was recorded.

The code that does this

The shipped popup handlers load Winfy RunWine URLs

Readable version

Show shipped source

Side-menu Run VLC handler

js/index.js

$(document).on('click', '.view_a', function (e) {	e.preventDefault();	exitMenu();	let locale = {               OK: 'OK',               CONFIRM: 'OK',               CANCEL: 'Cancel'        };        bootbox.addLocale('custom', locale);                bootbox.confirm('Confirm to start VLC online', function(result) {            console.log('Entering ' + result);            if ( result == true ) {                document.getElementById('preframex').style.display = "none";                document.getElementById('winfyout').style.display = "block";                                var iframe = document.createElement('iframe');                iframe.id ="winfyin";                iframe.width = "100%";                iframe.height = "850px";                iframe.src = 'https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init';                iframe.style.cssText = '';                //document.body.appendChild(iframe);                img = document.getElementById('winfyin');                img.parentNode.insertBefore(iframe, img);                img.parentNode.removeChild(img);                img = document.getElementById('winfyin');                                                                        //setTimeout(() => {                        //iframe.style.marginTop = "-7px";                        //iframe.style.marginBottom = "2px";                //}, 8000);            }        });        	//enterSecondaryView('view_a');});

Popup Run VLC button handler

js/index.js

document.getElementById('openvlc').onclick = function(){    exitMenu();	let locale = {           OK: 'OK',           CONFIRM: 'OK',           CANCEL: 'Cancel'    };    bootbox.addLocale('custom', locale);        bootbox.confirm('Confirm to start VLC online',  function(result) {        console.log('Entering 1 ' + result);        if ( result == true ) {            console.log('Entering 2 ' + result);            document.getElementById('preframex').style.display = "none";            document.getElementById('winfyout').style.display = "block";                        var iframe = document.createElement('iframe');            iframe.id ="winfyin";            iframe.width = "100%";            iframe.height = "850px";            iframe.src = 'https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init';            iframe.style.cssText = '';            //document.body.appendChild(iframe);            img = document.getElementById('winfyin');            img.parentNode.insertBefore(iframe, img);            img.parentNode.removeChild(img);            img = document.getElementById('winfyin');                                                            //setTimeout(() => {                    //iframe.style.marginTop = "-7px";                    //iframe.style.marginBottom = "2px";            //}, 8000);                    }   });}

Full-screen menu handler

js/index.js

$(document).on('click', '.view_b', function (e) {	e.preventDefault();	exitMenu();        window.open('https://www.winfy.net/runwine/start.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init');    return false;});

Remote destination reached by the Run VLC flow

- www.winfy.net
Receives the RunWine launch requests for the iframe and full-screen flows.

Extension popup loads and executes server-controlled content from winfy.net

LowunwantedCWE-829Dynamic sandbox

Clicking 'Run VLC' replaces the popup with a winfy.net iframe.

What actually happens

You did this

You click 'Run VLC' in the extension popup and confirm the dialog that appears.

There is no local media player, the button exists solely to initiate loading remote content.

The extension did this

The extension creates an iframe pointing at https://www.winfy.net/runwine/index_ext.php and replaces the popup UI with that iframe.

winfy.net then loads a WordPress page and executes three remote scripts inside the extension popup under a CSP that permits all remote HTTP scripts and eval.

Captured request

GEThttps://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init

WordPress page; server subsequently delivered twemoji.js, wp-emoji.js, and a text-editor bundle script from winfy.net, all executed in the extension popup context.

The code that does this

Iframe injection, minified source vs readable form

Readable version

Show shipped source

What this code does

js/index.js

// When user clicks 'Run VLC': // 1. Show a confirmation dialog // 2. If confirmed, hide the local UI (preframex) and show the remote iframe container (winfyout) // 3. Create a new <iframe> pointing at the winfy.net server // 4. Replace the placeholder iframe element with the live one // The extension ships no media player code — 100% of functionality is served remotely // // Identical logic also fires on .view_a (sidemenu 'Run VLC') click at line 259

Page DOM modified

The local button UI is removed from view and the full popup area is replaced by a live iframe loading remote server content from winfy.net.

Target: extension popup (start.html #page1)

Before

<div id="preframex" class="page-wrapper"> <!-- 'Run VLC' button and header --> <div id="ja-wrapper"> <h1>VLC Online</h1> <button id="openvlc">Run VLC</button> </div> </div> <div id="winfyout" style="display: none;"> <iframe id="winfyin" src="" width="100%" height="100%"></iframe> </div>

After the extension changed it

<div id="preframex" style="display: none;"></div> <div id="winfyout" style="display: block; height: 850px; width: 100%;"> <iframe id="winfyin" src="https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init" width="100%" height="850px"> </iframe> </div>

URL parameters sent to winfy.net on every popup activation

OS identifier
winfy-vlc-22.04.3-desktop-amd64
Identifies the operating system and distribution variant associated with this extension build.
Load mode
init
Tells the winfy.net server which page variant to deliver into the popup iframe.

Permissive Content Security Policy

The popup page (start.html line 4) sets Content-Security-Policy: default-src *; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'. This allows the winfy.net server to deliver scripts via any HTTP URL, execute inline JavaScript, and call eval() inside the extension popup. No Chrome extension API access is granted to the iframe itself, but the popup page's own script context operates under these relaxed rules.

Remote host receiving requests from the extension popup

- www.winfy.net
Hosts the popup via a WordPress page, delivering the UI and executing scripts in the popup context. Ownership and data handling aren't disclosed in the store listing.

What it can do

Permissions this extension asks for, as declared in version 1.1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

Store data in your browser
storage