Is Video Downloader Pro safe?
We analyzed Video Downloader Pro version 1.9.1's actual code and gave it a 45/100 trust score. This downloader has unusually broad access and handles…
Bottom line
This downloader has unusually broad access and handles session-related information, creating meaningful privacy and security concerns.
What it can access
It can run on every website, inspect pages, observe selected request headers, store session-related data, and download files; this is broader than the stated feature needs. [Q1]
Security weaknesses
A webpage can influence a media request, and loose website matching may select the wrong provider, creating a path for misuse. [Q21]
Signs of misuse
It automatically captures and stores X and Facebook session-related information while browsing, although the evidence shows reuse only with those same services. [Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has all-site host access, an all-page page access, tabs, scripting, webRequest, downloads and storage permissions. Most of this access is exercised by the video-downloader feature.
Declares <all_urls>, all-page content injection, webRequest, tabs, scripting, downloads and storage; all packaged resources are web-accessible on all sites. — manifest.json:21-36
Which websites can it run on, and can it read or change what appears on those pages?
Provider helpers inspect URLs, video elements, links, document titles and site-specific page structures. General sites are scanned for MP4 video sources every 100 milliseconds.
Continuously scans video elements, reads src URLs and page paths, and checks media size. — scripts/xxHelper.js:25
Reads Instagram video elements, post links, page URL and document-derived media information. — scripts/inHelper.js:25
Searches Facebook video elements and IDs in page URLs and DOM attributes. — scripts/fbHelper.js:25
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
DOM access targets video IDs and media elements; it does not inspect input values or messages. — scripts/fbHelper.js:25
DOM access targets video elements, tweet links and a named CSRF cookie. — scripts/twHelper.js:25
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It captures request metadata on X and Facebook and stores session-related material locally. It does not read Chrome's history database or bookmarks.
onBeforeSendHeaders stores all exposed X i/api request headers as tokens; onSendHeaders extracts fb_dtsg_ag from selected Facebook request URLs. — scripts/worker.js:1
Requests webRequest and storage but not history or bookmarks. — manifest.json:31-32
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can create browser downloads after the user clicks Download. It does not capture camera, microphone, location, screenshots or clipboard data.
The packaged React item component calls chrome.downloads.download from its Download click handler. — scripts/popup.js:38
Declares downloads but no device-capture or clipboard permission. — manifest.json:31-32
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It makes automatic requests to the viewed service and discovered media hosts to resolve video URLs and sizes. X headers and Facebook session values are sent only back to X or Facebook; no unrelated recipient was found.
Uses stored X request headers in a GET to api.x.com for the selected tweet. — scripts/worker.js:1
Sends Facebook's token, c_user value and video ID to facebook.com/video/video_data_async. — scripts/fbHelper.js:25
Queries Instagram GraphQL for post video URLs and issues HEAD requests to discovered media URLs. — scripts/inHelper.js:25
Requests Dailymotion metadata and media playlists for videos on Dailymotion. — scripts/dmHelper.js:25
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Provider selection, endpoints and response parsing are packaged locally. — scripts/worker.js:1
Uses service responses only to extract video URLs, titles and sizes. — scripts/inHelper.js:25
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Scanning, token capture and metadata requests happen automatically while the user browses. Saving a video requires a visible Download click.
Immediately reports the current location to the worker on every page. — scripts/content.js:1
Registers request-header listeners at worker startup and injects a provider helper automatically. — scripts/worker.js:1
Starts a 100ms scan loop after page load. — scripts/xxHelper.js:25
Downloads are attached to the popup's Download button. — scripts/popup.js:38
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings, proxy, privacy or management permission. — manifest.json:31-32
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Runtime bundles are minified and include large library copies, but complete source maps expose the original application source. No encrypted data was found.
Minified worker is accompanied by worker.js.map with embedded source content. — scripts/worker.js:1
Includes library boilerplate followed by inspectable first-party logic and an embedded source map. — scripts/fbHelper.js:1-25
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains the bundled regenerator Function("r", "regeneratorRuntime = r") compatibility fallback. — scripts/worker.js:1
The same library fallback uses only constant packaged text; application source contains no dynamic-code sink. — scripts/fbHelper.js:1-25
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Sends window.location internally to the worker at document end. — scripts/content.js:1
Uses the hostname to choose a packaged provider helper. — scripts/worker.js:1
Compares window.location.href during its scan loop but does not transmit it externally. — scripts/xxHelper.js:25
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores only total_number_of_downloads for a local review prompt. — scripts/popup.js:38
Contains no analytics or identifier endpoint. — scripts/worker.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It captures and persistently stores X request headers and a Facebook request token, and reads Facebook's c_user cookie. Those values are reused only with the same service, but storage lacks minimization, expiry or encryption.
Stores all request headers exposed for x.com/i/api requests under tokens and stores fb_dtsg_ag under currentFb_dtsgToken. — scripts/worker.js:1
Reads document.cookie for c_user and sends it with the Facebook token to Facebook's video metadata endpoint. — scripts/fbHelper.js:25
Reads the ct0 cookie and asks the worker to resolve an X video; the worker uses stored X headers against api.x.com. — scripts/twHelper.js:25
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Scans video src attributes only. — scripts/xxHelper.js:25
Reads video-related DOM and named session values, not form inputs or keyboard events. — scripts/fbHelper.js:25
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Parses fixed Instagram response fields into local video items. — scripts/inHelper.js:25
Parses fixed X response fields and returns media variants only. — scripts/worker.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds VPY_from_APL1 to processed video elements and removes it when the URL changes. — scripts/xxHelper.js:25
Uses the same marker-class pattern while scanning Facebook videos. — scripts/fbHelper.js:25
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It observes selected outgoing request headers, makes media GET/HEAD requests and creates downloads. It does not block, redirect or rewrite browsing traffic or configure a proxy.
Registers read-only webRequest listeners and uses chrome.downloads.download; no blocking option or response modification is active. — scripts/worker.js:1
Issues HEAD requests to discovered media URLs to obtain Content-Length. — scripts/xxHelper.js:25
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:31-32
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote JSON is parsed as media metadata; it is never passed to Function, eval, script injection or a string timer. — scripts/worker.js:1
The page-context helper is a fixed packaged file loaded with chrome.runtime.getURL, not remote code. — scripts/inStHelper.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
The Instagram helper exchanges a media URL through a page attribute that the page can also modify, and provider selection uses loose hostname substring checks. A malicious matching page may influence extension media requests, but access to stored tokens or response bodies from page code was not demonstrated.
Packaged page-world code writes VideoUrlForStory on document.head. — scripts/inStHelper.js:1
The isolated content helper reads that page-visible attribute and uses the resulting URL for a media-size request. — scripts/inHelper.js:25
Routes helpers with host.includes('instagram.com'), host.includes('facebook.com') and similar substring checks rather than exact domain validation. — scripts/worker.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads tokens from chrome.storage.local for X requests and writes currentFb_dtsgToken for Facebook helper use. — scripts/worker.js:1
Listens for currentFb_dtsgToken changes and uses the stored value in Facebook requests. — scripts/fbHelper.js:25
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Performs a 100ms DOM scan for new video elements; no mining algorithm or mining endpoint appears. — scripts/xxHelper.js:25
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Generic page code targets video elements only. — scripts/xxHelper.js:25
Site-specific code targets video IDs, media elements and named session values, not forms. — scripts/fbHelper.js:25