Is Video Speed Controller Pro safe?

Medium risk

Video Speed Controller Pro sends visited site hostnames and video speed changes to www.tinyflash.org.

Video Speed Controller Pro records the top-frame hostname after a page has been open for a few seconds and counts video playback-rate changes. On its analytics sync alarm, it sends new site, session, and speed-bucket totals to www.tinyflash.org/api/v1/stats.

v1.0.3Chrome Web Store
45Risk
Who publishes it

No other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Website
www.tinyflash.org/extensions/video-speed-controller-pro

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

VSC Pro sends your browsing hostnames and video speed habits to tinyflash.org

We observed VSC Pro record the hostname of every site you visit for 3+ seconds and every video speed change, then send those to www.tinyflash.org.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You visit any website, or a page with a video, and stay on it for a few seconds.

This happens on every page in every frame because the content script matches <all_urls>.

The extension did this

The content script records the site's hostname and any video-speed change, then the extension reports both to www.tinyflash.org.

The leading 'www.' is stripped before the hostname is stored, and pages named 'extensions' or 'newtab' are skipped.

What ends up in the report sent to tinyflash.org
  • Websites you visited
    {"en.wikipedia.org": 1}

    Every hostname you stayed on for 3+ seconds, with a running visit count.

  • Video playback speeds
    {"1.50": 1}

    How many times you set a video to each speed, across every site with a video.

  • Session count
    1

    A running count of pages you stayed on long enough to be recorded.

  • Extension ID
    jlhimcnaojgbmmmambapclkgonfcpajb

    A stable identifier for your install of VSC Pro, sent as a request header.

  • Extension version
    1.0.3

    The installed version number of VSC Pro.

The code that does this

content.js: the site-visit and video-speed recorder

Readable version
    function() {      try {        var e = function() {            if (0 !== Object.keys(t).length) {              var e = V({}, t);              t = {};              try {                chrome.storage.local.get(i.ANALYTICS_STATS_KEY, (function(t) {                  try {                    var n = t[i.ANALYTICS_STATS_KEY] || {                      speeds: {},                      sites: {},                      sessions: 0,                      lastUpdated: 0                    };                    for (var o in e) n.speeds[o] = (n.speeds[o] || 0) + e[o];                    n.lastUpdated = Date.now(), chrome.storage.local.set(U({}, i.ANALYTICS_STATS_KEY, n))                  } catch (e) {}                }))              } catch (e) {}            }          },          t = {},          n = null,          o = "";        try {          o = window.location.hostname.replace(/^www\./, "")        } catch (e) {          return        }        if (!o || "extensions" === o || "newtab" === o) return;        var r = null;        document.addEventListener("ratechange", (function(o) {          try {            if (!o.target || "VIDEO" !== o.target.tagName) return;            var i = o.target.playbackRate;            if ("number" != typeof i || i <= 0) return;            r && clearTimeout(r), r = setTimeout((function() {              r = null;              var o = i.toFixed(2);              t[o] = (t[o] || 0) + 1, n || (n = setTimeout((function() {                n = null, e()              }), 3e4))            }), 2e3)          } catch (e) {}        }), !0), setTimeout((function() {          try {            if (window !== window.top) return          } catch (e) {            return          }          try {            chrome.storage.local.get(i.ANALYTICS_STATS_KEY, (function(e) {              try {                var t = e[i.ANALYTICS_STATS_KEY] || {                  speeds: {},                  sites: {},                  sessions: 0,                  lastUpdated: 0                };                t.sites[o] = (t.sites[o] || 0) + 1, t.sessions += 1, t.lastUpdated = Date.now(), chrome.storage.local.set(U({}, i.ANALYTICS_STATS_KEY, t))              } catch (e) {}            }))          } catch (e) {}        }), 3e3), window.addEventListener("beforeunload", e)      } catch (e) {}    }()})();
When this fires

Every 1 day

A recurring alarm wakes the background service worker roughly once a day; it only sends a report if at least 6 hours have passed since the last one.

Captured request
POSThttps://www.tinyflash.org/api/v1/stats

200 OK; on success the extension advances its local 'last reported' watermark to these values so the next report only sends the new delta.

Headers
Content-Type
application/json
X-Extension-Id
jlhimcnaojgbmmmambapclkgonfcpajb
Body
{  "v": "1.0.3",  "speeds": {},  "sites": {    "en.wikipedia.org": 1  },  "sessions": 1}
Where your browsing and video-speed data goes
    • www.tinyflash.org

    Receives the hostnames of sites you've visited, your video playback-speed habits, and your extension ID.

Where it sends data

Destinations our analysis observed VSC Pro contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.tinyflash.org

    VSC Pro sends data to www.tinyflash.org. No other extension we have analysed sends data here.

Updated 30 September 2026jlhimcnaojgbmmmambapclkgonfcpajb