Is VLC online - multimedia player safe?

High risk

VLC online - multimedia player is high risk. Clicking 'Run VLC' replaces the popup with a winfy.net iframe. Dynamic analysis confirmed three WordPress scripts from winfy.net then run inside. The popup's CSP permits remote scripts, inline JS, and eval, so winfy.net can run code freely.…

Winfyv1.1.6Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Extension popup loads and executes server-controlled content from winfy.net

Clicking 'Run VLC' replaces the popup with a winfy.net iframe.

Dynamic analysis confirmed three WordPress scripts from winfy.net then run inside.

The popup's CSP permits remote scripts, inline JS, and eval, so winfy.net can run code freely.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click 'Run VLC' in the extension popup and confirm the dialog that appears.

There is no local media player, the button exists solely to initiate loading remote content.

The extension did this

The extension creates an iframe pointing at https://www.winfy.net/runwine/index_ext.php and replaces the popup UI with that iframe.

winfy.net then loads a WordPress page and executes three remote scripts inside the extension popup under a CSP that permits all remote HTTP scripts and eval.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init
WordPress page; server subsequently delivered twemoji.js, wp-emoji.js, and a text-editor bundle script from winfy.net, all executed in the extension popup context.
03EvidenceCODE COMPARE
The code that does this

Iframe injection, minified source vs readable form

What it actually does
What this code doesjs/index.js
// When user clicks 'Run VLC': // 1. Show a confirmation dialog // 2. If confirmed, hide the local UI (preframex) and show the remote iframe container (winfyout) // 3. Create a new <iframe> pointing at the winfy.net server // 4. Replace the placeholder iframe element with the live one // The extension ships no media player code — 100% of functionality is served remotely // // Identical logic also fires on .view_a (sidemenu 'Run VLC') click at line 259
04EvidenceDOM DIFF
Page DOM modified

Target: extension popup (start.html #page1)

The local button UI is removed from view and the full popup area is replaced by a live iframe loading remote server content from winfy.net.

Before
<div id="preframex" class="page-wrapper"> <!-- 'Run VLC' button and header --> <div id="ja-wrapper"> <h1>VLC Online</h1> <button id="openvlc">Run VLC</button> </div> </div> <div id="winfyout" style="display: none;"> <iframe id="winfyin" src="" width="100%" height="100%"></iframe> </div>
After (modified by extension)
<div id="preframex" style="display: none;"></div> <div id="winfyout" style="display: block; height: 850px; width: 100%;"> <iframe id="winfyin" src="https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init" width="100%" height="850px"> </iframe> </div>
05EvidenceFIELD TABLE
URL parameters sent to winfy.net on every popup activation
FieldValueWhy it matters
OS identifier
winfy-vlc-22.04.3-desktop-amd64Identifies the operating system and distribution variant associated with this extension build.
Load mode
initTells the winfy.net server which page variant to deliver into the popup iframe.
06EvidencePLAIN NOTE
Permissive Content Security Policy

The popup page (`start.html` line 4) sets `Content-Security-Policy: default-src *; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'`. This allows the winfy.net server to deliver scripts via any HTTP URL, execute inline JavaScript, and call `eval()` inside the extension popup. No Chrome extension API access is granted to the iframe itself, but the popup page's own script context operates under these relaxed rules.

07EvidenceTHIRD PARTY LIST
Remote host receiving requests from the extension popup
  • www.winfy.net

    Hosts the popup via a WordPress page, delivering the UI and executing scripts in the popup context. Ownership and data handling aren't disclosed in the store listing.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

VLC-branded extension loads Winfy instead of local playback

Listed as "VLC online - multimedia player" (VLC-style playback), the popup's "Run VLC" button replaces it with a Winfy RunWine iframe or page.

We found no local media-player, codec, video, or audio code; it only loads the remote Winfy URL.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You start the VLC-branded extension and choose "Run VLC."

The popup and side menu both present the action as starting VLC online.

The extension did this

The extension loads a remote Winfy RunWine page instead of running bundled media-player code.

The shipped handlers set an iframe to winfy.net or open a Winfy RunWine start page.

02EvidenceFIELD TABLE
Concrete values present in the shipped extension
FieldValueWhy it matters
Extension name
VLC online - multimedia playerThis is the name shown to you for the installed extension.
Extension description
Play most multimedia files, and various streaming protocols with this VLC distributed online.This tells you the extension is for playing multimedia files and streaming protocols.
Iframe launch URL
https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=initThis is the remote page the extension loads after you confirm the Run VLC action.
Full-screen launch URL
https://www.winfy.net/runwine/start.php?os=winfy-vlc-22.04.3-desktop-amd64&home=initThis is the remote page opened by the popup menu's full-screen option.
Stored Winfy state
winfykeyx = { uxr: "k9p4m2q8va", wifyc: "1" }The extension keeps a small local Winfy state record for later popup runs.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init
The shipped popup code sets this URL as an iframe source after the user confirms the Run VLC prompt; no request body was recorded.
04EvidenceCODE COMPARE
The code that does this

The shipped popup handlers load Winfy RunWine URLs

What it actually does
Side-menu Run VLC handlerjs/index.js
$(document).on('click', '.view_a', function (e) {
	e.preventDefault();
	exitMenu();

	let locale = {
               OK: 'OK',
               CONFIRM: 'OK',
               CANCEL: 'Cancel'
        };
        bootbox.addLocale('custom', locale);
        
        bootbox.confirm('Confirm to start VLC online', function(result) {
            console.log('Entering ' + result);
            if ( result == true ) {
                document.getElementById('preframex').style.display = "none";
                document.getElementById('winfyout').style.display = "block";
                
                var iframe = document.createElement('iframe');
                iframe.id ="winfyin";
                iframe.width = "100%";
                iframe.height = "850px";
                iframe.src = 'https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init';
                iframe.style.cssText = '';
                //document.body.appendChild(iframe);

                img = document.getElementById('winfyin');
                img.parentNode.insertBefore(iframe, img);
                img.parentNode.removeChild(img);
                img = document.getElementById('winfyin');
                            
                            
                //setTimeout(() => {
                        //iframe.style.marginTop = "-7px";
                        //iframe.style.marginBottom = "2px";
                //}, 8000);
            }
        });
        

	//enterSecondaryView('view_a');

});
Popup Run VLC button handlerjs/index.js
document.getElementById('openvlc').onclick = function(){
    exitMenu();

	let locale = {
           OK: 'OK',
           CONFIRM: 'OK',
           CANCEL: 'Cancel'
    };
    bootbox.addLocale('custom', locale);
    
    bootbox.confirm('Confirm to start VLC online',  function(result) {
        console.log('Entering 1 ' + result);
        if ( result == true ) {
            console.log('Entering 2 ' + result);

            document.getElementById('preframex').style.display = "none";
            document.getElementById('winfyout').style.display = "block";
            
            var iframe = document.createElement('iframe');
            iframe.id ="winfyin";
            iframe.width = "100%";
            iframe.height = "850px";
            iframe.src = 'https://www.winfy.net/runwine/index_ext.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init';
            iframe.style.cssText = '';
            //document.body.appendChild(iframe);

            img = document.getElementById('winfyin');
            img.parentNode.insertBefore(iframe, img);
            img.parentNode.removeChild(img);
            img = document.getElementById('winfyin');
                        
                        
            //setTimeout(() => {
                    //iframe.style.marginTop = "-7px";
                    //iframe.style.marginBottom = "2px";
            //}, 8000);
            
        }
   });
}
Full-screen menu handlerjs/index.js
$(document).on('click', '.view_b', function (e) {
	e.preventDefault();
	exitMenu();
    
    window.open('https://www.winfy.net/runwine/start.php?os=winfy-vlc-22.04.3-desktop-amd64&home=init');
    return false;

});
05EvidenceTHIRD PARTY LIST
Remote destination reached by the Run VLC flow
  • www.winfy.net

    Receives the RunWine launch requests for the iframe and full-screen flows.

Updated 17 September 2026jnldlhlanhljflfkkfcadgdcomnngpim