Chrome Web StoreCaution required
Suspicious in code review (v1.6.6 npy)
Our reviewer found behaviour consistent with malware in version 1.6.6 npy, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
2 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
YouTube™ Automatic HD/FPS/4k/8k High Quality is rated caution by Extension Auditor. Our code review reported 4 findings (2 high, 2 medium), led by other. Its permissions mean it can inject scripts into pages.
Key findings
- High
Other
The bundled manifest declares a single host permission (*://[domain withheld]) while the live CWS listing declares roughly 100 YouTube host patterns, and default_locale differs (en bundled vs zh_CN published). Every extra published host is a YouTube property, so the privilege delta is narrow in scope, but the shipped artifact does not match the listing, meaning analysis of either one alone misrepresents what users actually run. Combined with the version_name 'npy' flag that uses to suppress the paywall overlay, the publisher is clearly shipping build-specific variants.
- High
Other
The forced sign-in redirect is gated on a hardcoded wall-clock timestamp whose own comment states it waits three days to prove the store review has passed, and is additionally skipped for zh-CN UI locales. This is explicit time- and locale-based cloaking so that Google reviewers (and the publisher's own locale) never see the account-wall behaviour that other users get. The same block is bypassed when version_name contains 'npy', confirming the publisher ships reviewer-facing and user-facing variants of identical code.
- Medium
Other
The checkout page replaces its entire document with HTML fetched live from [domain withheld], so the server fully controls the DOM rendered inside the extension's own privileged origin, and the local code then branches on server-chosen markers. One of those markers, element id 'mian_fei_ling_qu' (commented "审核页面免费领取按钮" — review-page free-claim button), lets the server grant a month of membership and short-circuit payment, which is a server-side switch for presenting different behaviour to store reviewers than to paying users. MV3 CSP prevents script execution from this injected markup, which caps the impact at remote-controlled UI and entitlement state rather than remote code execution.
- Medium
Unauthorized Data Collection
Sign-in uses an authorization-code flow with access_type=offline for the user's Google profile and email, redirecting to the third-party intermediary [domain withheld] rather than to the publisher's own declared domain, so that operator can hold a long-lived refresh token for the user's Google identity. The resulting email address is then sent in the clear to [domain withheld] on every price lookup (:22) and the uid is appended to the uninstall URL (:101). None of these destinations is [domain withheld], [domain withheld] or [domain withheld], and the CWS data-collection disclosure for this extension is "none declared", so personally identifiable data is collected to an undisclosed third-party backend.
Analyst notes
The YouTube quality-setting core (,) is the ordinary open-source player-quality logic and there is no exfiltration of URLs, cookies, page content or history anywhere in the bundle. What is genuinely wrong is a grafted-on monetization SDK that deliberately hides itself from Google's reviewers::181 gates the login redirect behind a hardcoded epoch (1760959946 = 2025-10-20) with the comment "已超过3天后，证明审核通过了，才会显示登录" and exempts zh-CN UI locales, and:56-76 honours a server-supplied "审核页面免费领取" (reviewer free-claim) branch that silently grants a membership. It also funnels Google OAuth (access_type=offline, profile+email) through a third-party worker [domain withheld] and posts the user's email to [domain withheld], a domain unrelated to the declared publisher site ([domain withheld]) or either privacy policy ([domain withheld], [domain withheld]), while the CWS disclosure is "none declared". The ML evidence over-reads the bundle: html_base64_obfuscation maps to the Cloudflare beacon's SRI sha512 hash and versioned filename in:17 and:16, and the innerHTML hits are the locally-built paywall DOM; the remote HTML assigned at:29 and the cloudflareinsights beacon cannot execute script under MV3 CSP, so this is deceptive paywall plumbing rather than proven malware. Publisher reputation ( other extensions malicious) and the 11% malicious permhash cluster corroborate suspicion; chrome-stats' "removed-from-store" reason contradicts the listing data showing status active and an update 5 days ago.
YouTube™ Automatic HD/FPS/4k/8k High Quality Chrome extension security report
ID: idilfggbokokndjmolkipnhkahfafnep
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- httpcatcher
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Email Change History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
2 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Automatically adjust YouTube video quality to: HD/FPS/4K/8K or the highest resolution available
Read the publisher’s full description
Ladies and gentlemen, today I am going to introduce a revolutionary product to you. This is not just a plugin, it is a game rule that completely changes your experience of watching YouTube videos. Imagine that every time you open YouTube, you can immediately get the clearest and smoothest video quality without moving a finger. This is what our plugin can do. It can automatically select the highest clarity for you, avoiding those annoying clarity switches. It knows how to choose the best frame rate for your device, ensuring a smooth viewing experience. But that's not all. This plugin can also intelligently adjust according to your network environment, ensuring the best experience whether you are on high-speed Wi Fi or a snail like 3G network. For those who like to open multiple videos at the same time, this plugin is a godsend. It can optimize the video quality of each window, making your multitasking more efficient. We don't stop here. This plugin also allows you to personalize settings, allowing everyone to customize the most comfortable viewing experience according to their preferences. In addition to these amazing features that we already have, we are constantly innovating. In the future, we plan to join: Intelligent audio enhancement allows you to hear every word clearly even in noisy environments. Real time subtitle translation, breaking down language barriers. Video content preview allows you to know whether the video is worth watching before clicking. Intelligent advertising skipping saves you valuable time. Night mode automatically switches to protect your eyes. This is not just a plugin, it is a revolution in video viewing. It will completely change the way you use YouTube, making every viewing a pleasure. Now, who wants to go back to the era of manual adjustment in the past? We have prepared the future for you. Join us and create a new era of YouTube viewing together.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
2 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from httpcatcher
- YouTube™ automatically removes ads1,000 users
- G Search location switch434 users
- YouTube Skin212 users
- Web Page Magnifier – Magnifying Glass169 users
- Amazon Product Image Exporter89 users
Popular in Tools
- Montara Chrome Extension639,000,000 users
- 迅雷下载支持85,000,000 users
- ApexGuard VPN Proxy for Chrome10,000,000 users
- Zotero Connector9,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.