Extension Auditor
Extension Auditor
Sign Up

cast player

ID: dionggdmdobjjolppiiejleechniphok

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status
Removed
Version
0.8.1
Size
0.20 MB
Rating
3.0/5
Reviews
420
Users
100,000
Type
Extension
Updated
Feb 26, 2024
Category
Lifestyle Fun
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Author
krakesh14638View Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
2
Active
0
Obsolete
2
Listed
2
Unlisted
0
Total Users
100,001

Plays local videos on Chrome/Chromecast (with subtitles)

Now you can play local videos (movies on your desktop) on Chromecast (or Chrome) and control (play, pause, etc) All you have to do is drop some directory with .MP4 files (supports subdirectories) or drop the .MP4 file into your Chrome browser ALLOW EXTENSION: Access chrome://extensions/ and CHECK "Allow access to file URLs" from "cast player" extension. SUBTITLES support! You just need to have an .SRT file with the same name as the movie and in the same directory or choose your subtitles in the video player. Share us on Facebook (with Facebook post) Release notes: 0.8.1 fix bug css 0.8.0 fix auto load subtitles update player supports picture-in-picture mode (not supports subtitles)

Item
Type
Severity
Description
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.

By severity

Critical0
High0
Medium2
Low1

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
0.8.03

Files with findings

2 distinct paths — top paths by unique finding count:

  • static/background/index.js2
  • tabs/CastPlayer.99a957b6.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Network Interception
medium
static/background/index.js (line 90)The background service worker accepts a caller-supplied URL via runtime.onMessage / onMessageExternal (load-subtitle handler) and, before fetching it, installs a declarativeNetRequest session rule that rewrites the re…
0.8.0
2Privilege Escalation
medium
static/background/index.js (line 64)The onMessageExternal listener exposes the load-subtitle handler (see the network_interception finding) to any other installed Chrome extension without checking the sender's id or an externally_connectable allowlist i…
0.8.0
3Tracking
low
tabs/CastPlayer.99a957b6.js (line 7334)A hidden 0x0 iframe pointing at http://castplayer.me/?pageview=drop is injected into the CastPlayer extension tab. It silently beacons a pageview to the author's own server over cleartext HTTP whenever the extension t…
0.8.0
URLs
20
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
github.com/uuidjs/uuidhttps://github.com/uuidjs/uuid#getrandomvalues-not-supported
lodash.com-https://lodash.com/
openjsf.org-https://openjsf.org/
lodash.com/licensehttps://lodash.com/license
underscorejs.org/LICENSEhttp://underscorejs.org/LICENSE
npms.io/searchhttps://npms.io/search?q=ponyfill.
www.facebook.com-https://www.facebook.com
www.facebook.com/api/graphql/https://www.facebook.com/api/graphql/
www.facebook.com/reelhttps://www.facebook.com/reel
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
Showing 1 to 10 of 20 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Showing 1 to 3 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In