Is VLC online - multimedia player safe?
The extension sends the full URL of every page you navigate to, plus the previous URL, to www.winfy.net once a day.
On each top-level page load the extension reads the tab's previous URL, hex-encodes it with the current URL and a persistent random user ID, and sends it to www.winfy.net, limited to once per day. It also reports the URL of any .mp4 or .avi navigation to the same host, and opens a vendor tab if the server replies with an approval string.
Who publishes itWinfy - no other listings under this identity
Winfy - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension sends each page URL and previous URL to winfy.net once per day
Code analysis shows the extension sends a page address and the prior address for that tab, hex-encoded with a persistent random ID, to www.winfy.net once per day.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open or navigate to any web page in a tab.
The extension combines that page address with the tab's previous address and sends it to www.winfy.net, at most once a day.
Navigation listener and daily request in ws.js
Same logic as shipped; the file is not minified
ws.js// For each top-level commit: read prior URL for tabId, call oxintegra(currentUrl + '|||' + priorUrl),// then store currentUrl as the new prior URL for that tab.// oxintegra: return if already sent today; load or create random id (winfykeyx.uxr);// GET https://www.winfy.net/app/appwfvlc.php?dx=<day>&filepath=<hex(url|||prev)>&hex=1&u=<id>- Current and previous URLhttps://example.com/orders?id=1042|||https://example.com/
Full address of the page you loaded and the one before it in that tab, with query strings.
- Persistent user IDk3x9qmz2ab
A random 10-character ID created once and kept in local storage, linking each day's report.
- Day of month09
Used to limit the send to once per calendar day.
- Encoding flaghex=1
Marks the URL parameter as hex-encoded, which hides it from casual log reading.
- www.winfy.net
Receives hex-encoded URLs and the persistent ID; may reply OKOKOK to open a winfy.net info tab.
Every 1 day
Sends on the first navigation of each calendar day, gated by a stored day-of-month value.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Read and change your data on every site you visit
http://*/*
Store data in your browser
storage
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed VLC online - multimedia player contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.winfy.net
VLC online - multimedia player sends data to www.winfy.net. 6 other extensions we have analysed send data here.