Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video downloader

CRITICAL RISKRemoved from Chrome Web Store

Video downloader

ID: afhdhdllpdmajoopkogfdmdfdgmpjipp

Could be malicious

Supported Languages

🇪🇹Amharic

🇸🇦Arabic

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇱Hebrew

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇮🇳Kannada

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇮🇷Persian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇰🇪Swahili

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.0.0.11

Size

8.65 MB

Rating

3.9/5

Reviews

163

Users

500,000

Type

Extension

Updated

Feb 14, 2024

Publisher Contextual Analysis

Trusted

Author: https://video-downloader.videodown.siteView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

500,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Video Downloader - download any video from any website.

How to use： Go to the any website with video Click on Video downloader button in browser panel or find download button on a page Select video to download Why this video downloader? Unlimited downloads No ads No sponsored links Video Downloader is completely free Download instantly at your highest speed Works on multiple operating systems (Windows, Mac OS and Linux) No need to install additional software Features - Download and save videos playing on a website to hard disk - Download videos up to 8K resolution - Supports all popular video formats - Video downloader detects all resolutions available, so you can choose according to your needs what size is the best. Important: We had to disable the download function on YouTube because of restrictions of the Chrome Store. There are always videos which are protected by the sites and cannot be downloaded. Thank you for understanding. Try Video Downloader Now!

User Growth

Showing data from Oct 02, 2022 to Oct 01, 2023

Versions

-5.84%(-31,018 users)

Compared to 3 months ago

5 versions released in this period

Rating Count

Total: 25 ratings

Average Rating

Current: 3.84 / 5.0+3.84

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High7

Medium2

Low0

Versions scanned

Showing 2 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.6 Code review	5
1.0.0.2 Code review	10

Extension Version	Code Review Findings
1.0.0.6	5
1.0.0.2	10

Files with findings

6 distinct paths — top paths by unique finding count:

js/background.js7
js/connector.js2
js/provider.js2
js/providers/fb.js2
js/providers/tw.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/connector.js (line 49)	The extension injects a hidden iframe (`sandbox.html`) into every page it can access and establishes a `message` event listener with no origin filtering. Any message received from any origin on that page is forwarded …	1.0.0.2
2	Network Interception	critical	js/background.js (line 143)	The background script reads the remotely-fetched `dnl_settings` from storage and uses it to programmatically install `declarativeNetRequest` session rules that modify response headers. Because the header key and value…	1.0.0.2
3	Privilege Escalation	critical	js/background.js (line 392)	This is a generic RPC dispatcher that executes arbitrary `chrome.*` API chains and arbitrary `fetch()` calls based on attacker-controlled message fields. Combined with the unvalidated `postMessage` bridge in `js/conne…	1.0.0.6
4	Privilege Escalation	critical	js/background.js (line 318)	The `messageHandler` function exposes a generic Chrome API trampoline: any message with `type: 'chrome_api'` can specify an arbitrary `api_chain` array (e.g., `['cookies', 'getAll']`) and `params`, causing the backgro…	1.0.0.2
5	Privilege Escalation	critical	js/background.js (line 244)	On port disconnect, the background script reads serialized Chrome API call descriptors from `chrome.storage.local['d_cbs']` and blindly executes them. The `d_cbs` array items consist of an API chain `c` and parameters…	1.0.0.2
6	Remote Code Loading	critical	js/provider.js (line 156)	The extension fetches a remote JSON configuration file from an external server (videodown.site) and stores it as `dnl_settings` in chrome.storage.local. This configuration is then consumed by the background script to …	1.0.0.2
7	Code Injection	high	manifest.json (line 35)	The sandbox CSP explicitly enables both `'unsafe-eval'` and `'unsafe-inline'` for script sources. This means code running inside the sandbox page (`sandbox.html` / `provider.js`) can dynamically evaluate arbitrary str…	1.0.0.2
8	Credential Theft	high	js/providers/tw.js (line 1)	The Twitter provider hardcodes a Twitter OAuth2 bearer token directly in the extension source and also includes a Base64-encoded credential string used to obtain OAuth2 access tokens via the Twitter API. Additionally,…	1.0.0.2
9	Data Exfiltration	high	js/provider.js (line 35)	Messages from the sandbox iframe are sent to `window.top` using `postMessage` with `'*'` as the target origin, which means any frame in the page's frame hierarchy could intercept the response callbacks. This violates …	1.0.0.2
10	Network Interception	high	js/background.js (line 199)	The extension dynamically installs header-rewrite rules from `dnl_settings` stored in local storage, and `js/provider.js` downloads that settings blob from `https://videodown.site/video_d/<version>/dnl_settings.json`.…	1.0.0.6
11	Privilege Escalation	high	js/connector.js (line 57)	The injected connector listens for every `window.postMessage` event and forwards the unvalidated payload into the extension service worker. There is no origin, source, or schema check, so any visited page can talk to …	1.0.0.6
12	Tracking	high	js/background.js (line 135)	Every XHR request to `videodown.site` triggers a cookie write for that domain. The cookie value is hardcoded to `'1'` but the pattern establishes a covert tracking mechanism: the extension signals to the remote server…	1.0.0.2
13	Unauthorized Data Collection	high	js/providers/fb.js (line 1)	The Facebook provider extracts two sensitive values directly from Facebook's page DOM on construction: `async_get_token` (a Facebook authentication token used for API requests) and the user's `USER_ID`. These values a…	1.0.0.2
14	Tracking	medium	js/background.js (line 185)	The extension inspects outgoing request headers to `videodown.site` and sets a tracking-style cookie when a custom header value differs from a hardcoded URL. This is unrelated to core download functionality and indica…	1.0.0.6
15	Unauthorized Data Collection	medium	js/providers/fb.js (line 1)	The Facebook content script scrapes `async_get_token` and `USER_ID` values out of page scripts, which are user-specific tokens normally intended for Facebook's own frontend. Harvesting authenticated identifiers/tokens…	1.0.0.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
fonts.googleapis.com	/css	https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700&subset=latin,cyrillic
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.11	IPv4	-
0.0.0.0	IPv4	-
0.0.0.1	IPv4	-

2.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

I was trying to download from 123 movies and it said 'We are sorry, on the current page videos not found' and says the same thing on most other sites.

Suryansh Goel·7 Mar 2024

szintén sehonnan semmit...

Papa Kanoc·5 Mar 2024

it says any website but don't support porn website?

Carl Reings

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video downloader

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 9 Versions15

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating