Chrome Web StoreNo malware found
In code review (v2.4.6)
Our reviewer read version 2.4.6 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.
What our analysis found
VidHelper - Video Download Helper, used by 50,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by privilege escalation. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests.
Key findings
- High
Privilege Escalation
The content script runs at document_start on <all_urls> and forwards any page-dispatched CustomEvent("send-message") straight to the background's privileged message bus as {message: detail.message,...detail.data}, with no allowlist of permitted message names and no check that the event came from the extension's own injected code. Because window.dispatchEvent is callable by any website's own JavaScript, an arbitrary page can reach privileged handlers it was never meant to: "download-video-link" writes an attacker-chosen URL to disk under VidHelper/<fileName> via chrome.downloads, "send-notification" renders attacker-controlled text in a notification branded with the extension's own name and icon, and "get-cookies" honours a caller-supplied domain so cookies for an unrelated site are read. The relay discards the reply instead of posting it back to the page, so this is not a working exfiltration channel and reads as a missing-validation bug rather than intent, but it hands any visited site a privileged drive-by-download and notification-spoofing primitive. Verified non-exfiltration: the background's only reply paths are sendResponse (dropped by the relay) and the '<message>-chunk' tabs.sendMessage stream, which consumes in its own local Promise and never dispatches back into the page world.
Analyst notes
The supplied bundle held only 12 of 45 code files and was missing and, so I pulled the full 2.4.6 artifact from local CRX storage and reviewed those: every outbound destination in the complete build is first-party or expected ([domain withheld] + [domain withheld], GA4 with a random crypto.randomUUID clientId, Sentry, LemonSqueezy, and the video platforms themselves), and the two chrome.cookies sinks are benign - keeps one encrypted license cookie on [domain withheld], and reads and Instagram csrftoken only to build SAPISIDHASH and X-CSRFToken headers locally for requests back to [domain withheld], a direct port of yt-dlp's _get_sid_authorization_header. Everything the ML model keyed on resolves to vendor code or the extension's stated purpose, so the permhash cluster (5% malware) and the two IoC-list notes are contradicted by the source, while chrome-stats likelihood and the trusted-publisher badge corroborate; the one genuine defect is the unallowlisted page-to-background message relay reported below ( and were read from the archived 2.4.6 CRX, since the supplied bundle omitted them). Non-finding hygiene notes: harvests HLS AES-128 content keys (including SharePoint g_fileInfo.EncKey), which is a question rather than a security one since nothing leaves the browser; onMessageExternal exposes a fetch proxy to other extensions but not to web pages (no externally_connectable); and the YouTube function extracted from youtube's own runs in, a manifest-declared sandboxed page with no extension API access, which is the safest available design rather than privileged remote code loading.
VidHelper - Video Download Helper Chrome extension security report
ID: egmennebgadmncfjafcemlecimkepcle
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- vidhelper.app
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- No
- Domain exists
- No
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- No
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
About this extension
Download any video or audio from any website with just one click.
Read the publisher’s full description
Introducing VidHelper, a robust Video Download Helper that empowers you to effortlessly download videos from a vast array of platforms—over 1000 sites, including prominent social media platforms. VidHelper supports an extensive range of video formats. Notably, it seamlessly handles HLS and DASH streams, simplifying the downloading process for even the most intricate video formats. Enjoy the flexibility of accessing your favorite videos offline at your convenience, without the need for an internet connection. Share these videos with friends and family or store them for future viewing—VidHelper is your all-in-one solution for capturing and relishing online content. Key Features: - Compatibility with 1000+ video sites, making it easy for users to download and enjoy their favorite content from a wide range of online platforms. - Support for a variety of video formats. - Capabilities for downloading HLS (m3u8) and DASH (mpd) streams. - Built-in media player for Video Preview, streamlining your viewing experience. - QRCode links for effortless video sharing to your mobile phone. - Batch Download feature, enabling one-click download for all detected videos. - Supports recording mode to record video, audio and tabs. - Free, unlimited usage of our Video Download Helper with no registration requirements. How to Use Our Video Download Helper: 1. Visit the video site and click on our extension icon. 2. Videos will be listed on the popup page. 3. Choose the video you want to download. Enjoy! Note: Some web pages may require you to initiate video playback to assist the video downloader in locating the content. We sincerely hope you find our Video Download Helper valuable! Your feedback, ratings, and suggestions for enhancing functionality are highly appreciated. Disclaimer: VidHelper is not a Youtube Downloader. Due to restrictions outlined in the Google Web Store Policies and Developer Program Policies, downloading Youtube Videos is not supported. We appreciate your understanding.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in Accessibility
- 360 Internet Protection20,000,000 users
- Secure Exam Proctor8,000,000 users
- Volume Master7,000,000 users
- Dark Reader7,000,000 users
- Screenshot reader™7,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.