Is VLC online - multimedia player safe?
VLC online - multimedia player is high risk. Clicking 'Run VLC' replaces the popup with a winfy.net iframe. Dynamic analysis confirmed three WordPress scripts from winfy.net then run inside. The popup's CSP permits remote scripts, inline JS, and eval, so winfy.net can run code freely.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension popup loads and executes server-controlled content from winfy.net
Clicking 'Run VLC' replaces the popup with a winfy.net iframe.
Dynamic analysis confirmed three WordPress scripts from winfy.net then run inside.
The popup's CSP permits remote scripts, inline JS, and eval, so winfy.net can run code freely.
You click 'Run VLC' in the extension popup and confirm the dialog that appears.
There is no local media player, the button exists solely to initiate loading remote content.
The extension creates an iframe pointing at https://www.winfy.net/runwine/index_ext.php and replaces the popup UI with that iframe.
winfy.net then loads a WordPress page and executes three remote scripts inside the extension popup under a CSP that permits all remote HTTP scripts and eval.
Iframe injection, minified source vs readable form
// When user clicks 'Run VLC': // 1. Show a confirmation dialog // 2. If confirmed, hide the local UI (preframex) and show the remote iframe container (winfyout) // 3. Create a new <iframe> pointing at the winfy.net server // 4. Replace the placeholder iframe element with the live one // The extension ships no media player code — 100% of functionality is served remotely // // Identical logic also fires on .view_a (sidemenu 'Run VLC') click at line 259
Target: extension popup (start.html #page1)
The local button UI is removed from view and the full popup area is replaced by a live iframe loading remote server content from winfy.net.
<div id="preframex" class="page-wrapper"> <!-- 'Run VLC' button and header --> <div id="ja-wrapper"> <h1>VLC Online</h1> <button id="openvlc">Run VLC</button> </div> </div> <div id="winfyout" style="display: none;"> <iframe id="winfyin" src="" width="100%" height="100%"></iframe> </div>
<div id="preframex" style="display: none;"></div> <div id="winfyout" style="display: block; height: 850px; width: 100%;"> <iframe id="winfyin" src="https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init" width="100%" height="850px"> </iframe> </div>
| Field | Value | Why it matters | |
|---|---|---|---|
OS identifier | winfy-vlc-22.04.3-desktop-amd64 | Identifies the operating system and distribution variant associated with this extension build. | |
Load mode | init | Tells the winfy.net server which page variant to deliver into the popup iframe. |
The popup page (`start.html` line 4) sets `Content-Security-Policy: default-src *; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'`. This allows the winfy.net server to deliver scripts via any HTTP URL, execute inline JavaScript, and call `eval()` inside the extension popup. No Chrome extension API access is granted to the iframe itself, but the popup page's own script context operates under these relaxed rules.
- www.winfy.net
Hosts the popup via a WordPress page, delivering the UI and executing scripts in the popup context. Ownership and data handling aren't disclosed in the store listing.
VLC-branded extension loads Winfy instead of local playback
Listed as "VLC online - multimedia player" (VLC-style playback), the popup's "Run VLC" button replaces it with a Winfy RunWine iframe or page.
We found no local media-player, codec, video, or audio code; it only loads the remote Winfy URL.
You start the VLC-branded extension and choose "Run VLC."
The popup and side menu both present the action as starting VLC online.
The extension loads a remote Winfy RunWine page instead of running bundled media-player code.
The shipped handlers set an iframe to winfy.net or open a Winfy RunWine start page.
| Field | Value | Why it matters | |
|---|---|---|---|
Extension name | VLC online - multimedia player | This is the name shown to you for the installed extension. | |
Extension description | Play most multimedia files, and various streaming protocols with this VLC distributed online. | This tells you the extension is for playing multimedia files and streaming protocols. | |
Iframe launch URL | https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init | This is the remote page the extension loads after you confirm the Run VLC action. | |
Full-screen launch URL | https://www.winfy.net/runwine/start.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init | This is the remote page opened by the popup menu's full-screen option. | |
Stored Winfy state | winfykeyx = { uxr: "k9p4m2q8va", wifyc: "1" } | The extension keeps a small local Winfy state record for later popup runs. |
The shipped popup handlers load Winfy RunWine URLs
$(document).on('click', '.view_a', function (e) {
e.preventDefault();
exitMenu();
let locale = {
OK: 'OK',
CONFIRM: 'OK',
CANCEL: 'Cancel'
};
bootbox.addLocale('custom', locale);
bootbox.confirm('Confirm to start VLC online', function(result) {
console.log('Entering ' + result);
if ( result == true ) {
document.getElementById('preframex').style.display = "none";
document.getElementById('winfyout').style.display = "block";
var iframe = document.createElement('iframe');
iframe.id ="winfyin";
iframe.width = "100%";
iframe.height = "850px";
iframe.src = 'https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init';
iframe.style.cssText = '';
//document.body.appendChild(iframe);
img = document.getElementById('winfyin');
img.parentNode.insertBefore(iframe, img);
img.parentNode.removeChild(img);
img = document.getElementById('winfyin');
//setTimeout(() => {
//iframe.style.marginTop = "-7px";
//iframe.style.marginBottom = "2px";
//}, 8000);
}
});
//enterSecondaryView('view_a');
});document.getElementById('openvlc').onclick = function(){
exitMenu();
let locale = {
OK: 'OK',
CONFIRM: 'OK',
CANCEL: 'Cancel'
};
bootbox.addLocale('custom', locale);
bootbox.confirm('Confirm to start VLC online', function(result) {
console.log('Entering 1 ' + result);
if ( result == true ) {
console.log('Entering 2 ' + result);
document.getElementById('preframex').style.display = "none";
document.getElementById('winfyout').style.display = "block";
var iframe = document.createElement('iframe');
iframe.id ="winfyin";
iframe.width = "100%";
iframe.height = "850px";
iframe.src = 'https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init';
iframe.style.cssText = '';
//document.body.appendChild(iframe);
img = document.getElementById('winfyin');
img.parentNode.insertBefore(iframe, img);
img.parentNode.removeChild(img);
img = document.getElementById('winfyin');
//setTimeout(() => {
//iframe.style.marginTop = "-7px";
//iframe.style.marginBottom = "2px";
//}, 8000);
}
});
}$(document).on('click', '.view_b', function (e) {
e.preventDefault();
exitMenu();
window.open('https://www.winfy.net/runwine/start.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init');
return false;
});- www.winfy.net
Receives the RunWine launch requests for the iframe and full-screen flows.