Is Movie Downloader safe?
We analyzed Movie Downloader version 0.3.0's actual code and gave it a 68/100 trust score. This appears to be a functional movie-link downloader, but its…
Bottom line
This appears to be a functional movie-link downloader, but its broad website monitoring creates meaningful privacy exposure even though no misuse or outside data sharing was found.
What it can access
The extension can observe matching media links across all HTTP and HTTPS websites and use browser tabs, downloads, and clipboard writing. [Q1] [Q12] These powers support its downloader purpose, but the all-site monitoring is broader than necessary for a particular movie site. [Q8]
Signs of misuse
There is no evidence that it sends collected information elsewhere, reads passwords or session data, runs remotely supplied code, or accepts commands from ordinary websites. [Q6] [Q7] [Q14] [Q16] Its local recording of media links is a privacy concern, but not established abuse. [Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests broad access to HTTP and HTTPS websites, browser tabs, downloads, and clipboard writing; monitoring media links and downloading them fit its stated purpose, but access covers far more sites than necessary for any one download.
The manifest requests tabs, downloads, webRequest, clipboardWrite, and access to all HTTP and HTTPS website addresses. — manifest.json:1
It observes web requests across tabs and retains matching media URLs. — background.js:19-37
It starts downloads only after the user clicks a download button. — popup.js:33-42
It writes a displayed media URL to the clipboard after a user action, without reading clipboard contents. — popup.js:72-79
Which websites can it run on, and can it read or change what appears on those pages?
It can communicate with the listed websites, but the manifest does not declare automatic page scripts.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: http://*/*, https://*/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No code reads password fields, payment details, messages, or other form entries. It records matching network request URLs, which could contain sensitive URL data if a site places it there.
Only request URLs are examined; there is no DOM or form-field access. — background.js:19-37
The popup requests recorded video URLs for the current tab. — popup.js:11-16
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No code accesses cookies, browsing history, bookmarks, downloads history, or signed-in website sessions. It can initiate a download only when the user clicks a displayed button.
The permissions include tabs and downloads but not cookies, history, bookmarks, or sessions. — manifest.json:11-16
chrome.downloads.download is called from a Download button click. — popup.js:33-42
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests access outside ordinary web pages: clipboardWrite.
The manifest requests: clipboardWrite — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
There is no code sending collected information to an outside server. The extension observes request URLs locally and displays them in its popup.
Stores matching URLs in the in-memory allResults object. — background.js:5-16
Returns stored results to the popup through an internal runtime message. — background.js:71-75
Does it download or run code, settings, or instructions supplied by a remote server?
No remote code, settings, or instructions are downloaded or executed. The only executable JavaScript is bundled in the extension files.
The manifest lists only bundled background.js and popup.html as extension entry points. — manifest.json:1-18
The request listener records and classifies URLs but does not fetch or execute response content. — background.js:19-37
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Without a user request, it monitors all web requests and records matching video URLs, then changes the extension icon. Downloads and clipboard writes require explicit popup button clicks.
The onBeforeRequest listener automatically processes requests and records matching URLs. — background.js:19-35
Matching requests automatically enable the browser-action icon. — background.js:27-34
Downloading occurs inside a button click handler. — popup.js:33-42
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The available JavaScript is short, readable, and not obfuscated or dynamically generated. No third-party runtime code is present in the listed extension files.
Readable source implements request monitoring, tab bookkeeping, and messaging. — background.js:1-75
Readable source implements popup display, download, and clipboard actions. — popup.js:1-86
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No eval(), new Function(), or string-based timer execution is present in the inspected source.
No dynamic code execution APIs appear. — background.js:1-75
Uses ordinary event handlers and DOM operations, without eval or string timers. — popup.js:1-86
Does it track the websites, pages, searches, or links you visit?
The extension monitors HTTP and HTTPS requests in every tab and stores matching M3U8, MP4, FLV, MKV, and AVI URLs by tab. This reveals media resources requested by visited pages, but the collected data is kept in extension memory and is not transmitted externally.
A webRequest listener covers <all_urls>, examines each requested URL, and records matching media URLs. — background.js:19-37
Matching URLs are stored in the global allResults object under the requesting tab ID. — background.js:5-16
Results are removed when a tab closes, but remain in memory while the tab exists. — background.js:67-69
Does it create a persistent ID or browser fingerprint to recognize you?
The extension does not create a persistent identifier or browser fingerprint. It keeps video URLs temporarily by tab ID in memory.
Stores detected URLs in an in-memory object keyed by tab ID; no generated ID or fingerprinting code is present. — background.js:1-16
Does it send cookies, session details, authentication data, or page contents elsewhere?
No code sends cookies, login/session data, authentication information, or page contents to another service. It records only matching media request URLs locally.
Observes request URLs and stores matching .m3u8, .mp4, .flv, .mkv, and .avi URLs; no outbound reporting request is made. — background.js:19-37
Does it record typing, form entries, clipboard contents, or screenshots?
There is no typing, form, clipboard-reading, or screenshot capture. The extension only writes a detected video URL to the clipboard when the user clicks a button.
Uses navigator.clipboard.writeText to copy a displayed URL; there is no clipboard read or input-monitoring code. — popup.js:72-79
Can a website or remote server send commands that make the extension take actions?
The extension has no remote command channel. Its message listener accepts popup requests only to return URLs already collected for a tab.
Responds to runtime messages with allResults[request.tabId] and does not execute commands from the request. — background.js:71-75
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It does not alter links, referral codes, advertisements, shopping carts, or search results. It only displays detected media URLs and offers downloads or copying.
Builds a popup listing recorded media URLs and creates download/copy buttons; no page-link or ad modification is performed. — popup.js:17-80
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It monitors web requests but does not redirect or modify them. The request listener explicitly allows each request to continue unchanged.
The webRequest listener inspects URLs and returns { cancel: false }; it does not change headers, URLs, downloads, or proxy settings. — background.js:19-37
Can it communicate with software on the computer or services running on localhost?
No communication with native computer software or localhost services is implemented.
Only browser APIs for web requests, tabs, icons, and runtime messaging are used; there are no native-messaging or localhost requests. — background.js:1-75
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
It does not decode, decrypt, unpack hidden data, or execute injected code. The only URL transformation changes “master” to “index-v1-a1” for copying.
Performs a simple string replacement on M3U8 URLs; no decoding, decryption, unpacking, eval, or injection is present. — popup.js:62-66
Can ordinary websites access privileged extension features through messaging or exposed files?
The background listener accepts messages from extension contexts but the manifest exposes no web-accessible files or externally connectable website messaging, and no webpage bridge is established in the inspected code. Ordinary websites therefore are not shown to have direct access to the extension’s privileged features.
The manifest contains no externally_connectable or web_accessible_resources declaration. — manifest.json:1-26
The runtime message listener returns stored results, but this API is not by itself a webpage-accessible interface and the listener does not establish a page bridge. — background.js:71-75
The privileged webRequest functionality is registered internally in the background page and is not exposed as a callable webpage API. — background.js:19-37
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No user-, site-, date-, or remote-setting-based activation logic is present. Detection is based only on whether a request URL ends in a listed media extension.
Activation depends on .m3u8 or supported video-file URL patterns, with no remote configuration or targeting conditions. — background.js:19-35
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
There is no hidden resource-intensive work such as cryptocurrency mining. The extension performs lightweight URL tracking and user-triggered downloading.
The request handler only matches URLs, stores them, and changes the toolbar icon. — background.js:19-37
Does it change form fields or where a form sends its information?
It does not change form fields or form destinations. Its only URL adjustment is a local string replacement used when copying an M3U8 link.
Changes “master” to “index-v1-a1” in a displayed video URL; no forms or page submissions are accessed. — popup.js:62-66