Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Downloader Professional

CRITICAL RISKRemoved from Chrome Web Store

Video Downloader Professional

ID: adahebendgkgacfmpnmoddebbnfpfkcd

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.7

Size

0.39 MB

Rating

4.7/5

Reviews

5,160

Users

1,087,939

Type

Extension

Updated

Jan 14, 2021

Publisher Contextual Analysis

Author: videodownloaders.ioView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,087,939

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Video Downloader Professional - the fastest and easiest way to save any video from any website.

Save any online video from your favorite websites with this Video Downloader. No more delays to watch videos online, the evolution of downloaders has come, this extension will become your favorite video saver. The extension is very easy to use. You only need to click on the icon of the extension in your Chrome browser and within seconds you will begin to download the video to your PC, the extension is completely free, safe, fast and easy to add to chrome browser. Download any online video format such as Flv video, mp4, Mov, Webm, and more. Easy, fast, safe and light!. You can download multiple videos simultaneously. You don't need to watch the videos online, you can now download all to your computer!

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High9

Medium2

Low1

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.7 Code review	6
1.6 Code review	8

Extension Version	Code Review Findings
1.7	6
1.6	8

Files with findings

7 distinct paths — top paths by unique finding count:

js/background.js6
js/popup.js2
js/providers/tw.js2
js/_config.js1
js/contentscript.js1
js/providers/fb.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/background.js (line 1)	The extension intercepts outbound Facebook AJAX and video API requests to silently extract the `fb_dtsg_ag` anti-CSRF token from URL parameters. This token authenticates requests to Facebook's internal APIs on behalf …	1.6
2	Credential Theft	critical	js/providers/fb.js (line 1)	The FBProvider reads the `c_user` Facebook user-ID cookie via `getCookie('c_user')` and combines it with the previously stolen CSRF token (`fb_dtsg_ag`) to forge authenticated requests to Facebook's private `video_dat…	1.6
3	Credential Theft	high	js/providers/tw.js (line 1)	The TWProvider reads the user's active Twitter CSRF cookie (`ct0`) via `getCookie('ct0')` and attaches it to OAuth2 token requests sent to the Twitter API. This abuses the user's authenticated Twitter session to obtai…	1.6
4	Network Interception	high	js/background.js (line 52)	The extension pulls a remote JSON config from `https://videodownloader.site/api/config/`, sends a persistent UID plus version/timestamp, and immediately applies whatever fields the server returns. One server-controlle…	1.7
5	Network Interception	high	js/background.js (line 99)	This hook watches completed top-level navigations, derives the visited domain, and builds a server-defined affiliate URL template. Depending on remote config, it can trigger additional hidden requests or redirects bas…	1.7
6	Network Interception	high	js/background.js (line 1)	The extension uses `webRequestBlocking` to strip all `X-Frame-Options` response headers from every Facebook page load. This disables clickjacking protection on facebook.com for the affected user, enabling any page in …	1.6
7	Remote Code Loading	high	js/contentscript.js (line 49)	The content script injects Mixpanel onto arbitrary webpages and initializes it with values taken from extension config. Because this runs in the page context and can also copy `pageOptions` from config onto `window`, …	1.7
8	Remote Code Loading	high	js/providers/tw.js (line 1)	The Twitter provider fetches OAuth2 application credentials dynamically from `wisevideodownloader.com/tw-token/` and replaces the hardcoded base64 credential at runtime. This is a remote code / credential loading patt…	1.6
9	Tracking	high	js/background.js (line 317)	The background processor maintains a redirect chain of URLs and POSTs that full chain to a remote endpoint defined by config. This is a concrete browsing-telemetry exfiltration path, and because the destination is rem…	1.7
10	Unauthorized Data Collection	high	js/background.js (line 452)	This code removes Facebook's `X-Frame-Options` response header and harvests the `fb_dtsg_ag` token from Facebook requests into extension storage. Stripping clickjacking protections and capturing anti-CSRF/session-adja…	1.7
11	Unauthorized Data Collection	high	js/popup.js (line 1)	Every time the popup is opened on a page with no detectable video, the extension silently sends the user's current browsing domain to an external third-party server at `dwnpro.com`. This occurs without any user consen…	1.6
12	Privilege Escalation	medium	manifest.json (line 2)	The manifest uses `web_accessible_resources: ["*"]` which exposes every extension file (including scripts and data) to any web page via `chrome-extension://` URLs, enabling web pages to probe extension internals or ex…	1.6
13	Remote Code Loading	medium	js/_config.js (line 1)	The configuration embeds a dedicated URL (`wisevideodownloader.com/tw-token/`) for remotely fetching Twitter API credentials at runtime. The operator controls this endpoint and can change the credentials served to all…	1.6
14	Tracking	low	js/popup.js (line 44)	When no downloadable video is found, the popup sends the current tab's hostname to `dwnpro.com` over plain HTTP. This is unsolicited browsing telemetry and uses an insecure transport that exposes the data to network o…	1.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It cannot download fb nor youtube video.

Adam Wong·7 Feb 2021

WHERE DOES IT DOWLAOD TO PRATS????

Lord Wispa·6 Feb 2021

não reconhece vídeo. o anterior funcionava na perfeiç��o

Beacake Sousa·5 Feb 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Downloader Professional

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews