Security Warning: Historically Flagged as Malware

This extension is historically labeled as malware, but the current version analysis does not yet confirm severe malicious findings.Extension: Fast Video Downloader

HIGH RISKStill available - needs review

Fast Video Downloader

ID: chpclagihmacijidfebcjomopblckhmd

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Active

Version

1.5

Size

10.00 MB

Rating

4.0/5

Reviews

Users

996

Type

Extension

Updated

May 6, 2026

Publisher Contextual Analysis

Author: simonggenstorferView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

996

Save any video or live stream from any website. Download MP4/WebM videos, record streams, and store content with one click.

Save any video or live stream from any website. Download MP4/WebM videos, record streams, and store content with one click. Fast Video Downloader lets you save any video from a website with just one click. Whether it's a social media clip, a movie trailer, or a live stream (where it is legally allowed), this tool ensures you never miss a moment. What is so special about my video grabber? The Downloader works almost on all websites where you can find a video; just click the button and downloading will start. ⚡ Instant Video Downloads – Save MP4/WebM videos from any website 📡 Live Stream Recording – Capture and store streams from major platforms 🌍 Universal Compatibility – Works on news sites, social media, entertainment hubs, and more 🖱️ One-Click Simplicity – No complicated setup, just add to your Chrome and start downloading How to FVD extension? 1️⃣ Add it to your Chrome browser from Chrome Store Page 2️⃣ Go to any website with a video or live stream 3️⃣ Check the Fast icon – if it appears, the video is available for download 4️⃣ Click and save – download instantly or record a live stream FVD supports most of Major Video Hosting Platforms and social networks All saved files are automatically stored in your browser's default storage folder. With Fast Video Downloader, if you can watch it—you can save it. Get started now and take full control of your content! 🚀

User Growth

Showing data from Mar 17, 2025 to Aug 02, 2026

Versions

+33.69%(+252 users)

Compared to Apr 23, 2025

3 versions released in this period

Item	Type	Severity	Description
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
declarativeNetRequestWithHostAccess	Permission	Critical	This permission combines network request modification with host permissions. Rated Critical because it can modify requests for specific domains, potentially targeting sensitive websites with precise attack rules.
:///*	Host	Critical	Broad host access — the extension can read/modify content on every website.
downloads	Permission	High	This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
offscreen	Permission	High	This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk: • 10% increase: Early script execution enables pre-emptive content manipulation • 25% increase: Unsafe code evaluation capabilities increase attack surface
Broad Host Permissions	Risk Factor	High	This extension has broad host permissions allowing it to access many or all websites.
Unsafe WebAssembly Execution	Risk Factor	High	This extension's CSP allows "wasm-unsafe-eval".
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.

The webRequest.onBeforeSendHeaders listener captures Instagram internal auth headers (x-ig-www-claim, x-ig-app-id, x-asbd-id, x-csrftoken) from all Instagram XHR requests and persists them to chrome.storage.local. These are subsequently read by the content script's Instagram class (app.js:1043-1047) to make authenticated calls to Instagram's own /api/v1/media/ endpoint for video resolution. No evidence of exfiltration to a third-party host was found, but storing CSRF tokens in extension storage is a hygiene concern — a future malicious update could trivially exfiltrate them.

js/sw.js (Line 2215)

Bt(t) {  !t.requestHeaders || t.requestHeaders.length < 1 || chrome.storage.local.get(E, (e => {    let r = e[E] || {};    for (let e = 0; e < t.requestHeaders.length; ++e) {      let i = t.requestHeaders[e].name.toLowerCase();      i === g && (r[g] = t.requestHeaders[e].value), i === v && (r[v] = t.requestHeaders[e].value),        i === S && (r[S] = t.requestHeaders[e].value), i === y && (r[y] = t.requestHeaders[e].value)    }    const i = {};    i[E] = r, chrome.storage.local.set(i)  }))}

The Facebook integration extracts the user's fb_dtsg_ag session token and numeric user ID from page script tags, then calls Facebook's internal video_data_async endpoint with them. This is a technique used by video downloaders to resolve HD/SD/DASH URLs from authenticated sessions. The call goes to Facebook's own servers with the user's existing session — no third-party exfiltration — but it does scrape internal session tokens from page DOM.

js/app.js (Line 711)

let s =  `https://www.facebook.com/video/video_data_async/?video_id=${r.video_id}&fb_dtsg_ag=${r.async_get_token}&__user=${r.user_id}&__a=1`;fetch(s)  .then((t => t.text()))  .then((e => {

By severity

Critical0

High0

Medium0

Low2

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5 Code review	2

Extension Version	Code Review Findings
1.5	2

Files with findings

2 distinct paths — top paths by unique finding count:

js/app.js1
js/sw.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Unauthorized Data Collection	low	js/sw.js (line 2215)	The webRequest.onBeforeSendHeaders listener captures Instagram internal auth headers (x-ig-www-claim, x-ig-app-id, x-asbd-id, x-csrftoken) from all Instagram XHR requests and persists them to chrome.storage.local. The…	1.5
2	Unauthorized Data Collection	low	js/app.js (line 711)	The Facebook integration extracts the user's fb_dtsg_ag session token and numeric user ID from page script tags, then calls Facebook's internal video_data_async endpoint with them. This is a technique used by video do…	1.5

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

No URLs found

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found

4.0 out of 5 · 4 most recent reviews

Text reviews

Positive

Negative

Nice little tool to have. Thank you developer

Felix Krause·23 Jul 2026

I think negative reviews come from people expecting to download from YouTube. That’s not how Chrome extensions work — Google won’t allow extensions in the Chrome Web Store to download their own content. Try it on other websites, not YouTube or Netflix, and you’ll see how well it works.

Rasmus C. Jessen·19 Jun 2026

it does nothing, theres not even a button to start downloading, not even if I start playing the videos, nothing

Version	Size	Is Malicious	Findings	Permhash
1.5 Latest	10.00 MB	Malicious	2	26daf708006d0d8e98a30e3808378f80b718075693c72a095b865f119f9f90b3
1.2	10.08 MB	Malicious	—	26daf708006d0d8e98a30e3808378f80b718075693c72a095b865f119f9f90b3
1.0	10.02 MB	Malicious	—	26daf708006d0d8e98a30e3808378f80b718075693c72a095b865f119f9f90b3

Showing 1 to 3 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Warning: Historically Flagged as Malware

Fast Video Downloader

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Static Code Security Analysis

Manifest File Security Analysis

Code Analysis

Code Review Findings Summary Across 3 Versions2

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating

Security Warning: Historically Flagged as Malware

Fast Video Downloader

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Static Code Security Analysis

Manifest File Security Analysis

Code Analysis

Unauthorized Data Collectionlowjs/sw.js

Unauthorized Data Collectionlowjs/app.js

Code Review Findings Summary Across 3 Versions2

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating