Is Video Downloader Plus safe?
We analyzed Video Downloader Plus version 4.0.0's actual code and gave it a 68/100 trust score. This is a useful but broadly empowered downloader that…
Bottom line
This is a useful but broadly empowered downloader that collects media-related browsing information and depends on Vidow’s service.
What it can access
The extension can inspect pages on all websites and process media-related network activity. [Q2] This broadly matches a downloader, but it is more access than a single-site feature needs and includes optional file downloading. [Q1]
Security weaknesses
All-site page access and automatic background observation create opportunities for websites or attackers to misuse media-related access. [Q2] A Vidow page can also request a limited set of privileged download and network actions through its bridge. [Q16]
Signs of misuse
The extension automatically observes media on visited pages and can send detected page or video URLs to Vidow. [Q12] It also uses a persistent installation identifier for service requests, creating tracking potential, although the evidence ties this to downloader features rather than unrelated data.
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests access across all websites to detect and process videos, which fits its downloader purpose but is broad and allows media-related page observation and changes.
The extension requests tabs, webRequest, declarativeNetRequest, and storage permissions, optional downloads access, and <all_urls> site access. — manifest.json:1
A content script runs in all frames on all websites, while a second bridge runs on specified Vidow stream and cast pages. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: <all_urls> — manifest.json:1
Content scripts run directly on: *://*/*, *://app.vidow.io/video/stream/*, *://app.vidow.io/video/cast/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No code was found that reads input values, keystrokes, passwords, payment fields, messages, or form submissions. The content script inspects media and page metadata instead.
The visible page inspection targets anchors, video/audio/source elements, metadata, JSON-LD, posters, and images; it does not select or read form controls. — content_scripts/content_script.js:1-1
Although scripts run broadly, the manifest alone does not demonstrate collection of typed data. — manifest.json:1-1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It uses extension storage and tab information, but no evidence was found that it reads browser cookies, history, bookmarks, or downloads. Network requests may use normal website credentials for the extension service or media requests, not direct cookie access.
Declared permissions include tabs, webRequest, declarativeNetRequest, and storage, but not cookies, history, bookmarks, or downloads as a required permission. — manifest.json:1-1
The code uses chrome.tabs and storage and handles network headers, but searches found no chrome.cookies, chrome.history, or bookmark APIs. — background/service_worker.js:1,5
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends detected or selected video URLs and related metadata to Vidow’s remote service for video lookup, account features, limits, casting, or downloads. It also makes authenticated requests to that service, which may include the extension service’s own login credentials.
The content script detects media and sends page/video information to extension code. — content_scripts/content_script.js:1
The service worker calls the remote video-information endpoint with a URL and performs account and video-service requests. — background/service_worker.js:1
The request wrapper defaults to credentials: include for its configured service requests. — assets/js/storageLock.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence was found that remote responses are executed as code or treated as extension instructions. Remote data is parsed as JSON/video metadata, while the bundled HLS library is local code.
Remote video-service responses are parsed and stored as data. — background/service_worker.js:1
The extension-page CSP permits only self-hosted scripts and disallows inline/eval-style script sources. — manifest.json:1-1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Without a new click on every page, the extension scans matched pages, observes media changes, processes network events, and can issue lookup or media requests. Some download or tab-changing actions require extension UI or message flows, so this does not establish unrestricted automatic downloading or browsing redirection.
The all-pages content script runs at document end, scans the DOM, observes changes, and reports detected media. — content_scripts/content_script.js:1
The service worker handles media network events and performs background lookups or media-related requests. — background/service_worker.js:1
The content script is automatically injected on all URL matches, while the bridge has narrower matches. — manifest.json:33-44
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Some important files are heavily bundled/minified, especially the large background worker and HLS player, making manual inspection harder. The reviewed package is locally bundled rather than obviously fetched from a third-party runtime script, but coverage is less transparent than readable source.
The service worker is a large bundled/minified file containing substantial logic on very few lines. — background/service_worker.js:1-5
The HLS library is a large bundled/minified dependency with dense generated code. — assets/js/hls-player.js:1-40
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
Searches found no use of eval(), new Function(), or string-based timers in the extension code. Ordinary timer callbacks are present, but they do not turn text into code.
The extension-page CSP explicitly restricts scripts to self-hosted code and does not allow eval. — manifest.json:1-1
Observed setTimeout/setInterval uses pass function callbacks; no executable strings were found. — background/service_worker.js:1
Does it track the websites, pages, searches, or links you visit?
The extension observes every matched page for media and can send detected page or video URLs to Vidow’s service. This is tracking of media-related browsing activity rather than evidence of a complete history or search tracker.
The main content script matches all URLs and all frames at document end. — manifest.json:33-39
The script reads page location and media-related page data, including dynamically added media. — content_scripts/content_script.js:1
Detected URLs can be used in remote video-information lookups and cached extension state. — background/service_worker.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
The extension creates and stores a persistent random device identifier and reuses it in service requests. This identifies the extension installation or device record, but the reviewed behavior does not establish a hardware-based browser fingerprint.
Popup logic creates or retrieves a UUID-like device key and sends it with feature requests. — assets/js/popup.js:1
Background service flows use device-related state for service operations. — background/service_worker.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends video URLs and metadata to Vidow and makes authenticated requests to Vidow’s own service. It also observes cookies in relevant media-request handling, but the available evidence does not prove that arbitrary cookies or page contents are copied to an unrelated destination.
The service worker performs authenticated Vidow requests and handles media request headers, including cookie-related data in download flows. — background/service_worker.js:1
The service request wrapper uses credentials: include, allowing the browser to attach cookies for the configured service origin. — assets/js/storageLock.js:1
Feature requests include video URLs, source information, titles, thumbnails, quality, and device identifiers. — assets/js/popup.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records typing, form values, clipboard contents, or screenshots. The content script reads video-related DOM elements and thumbnail metadata instead.
Scans links, video/audio elements, metadata, JSON-LD, posters, and images for video and thumbnail information; no keyboard, form, clipboard, or screenshot APIs are used. — content_scripts/content_script.js:1
Can a website or remote server send commands that make the extension take actions?
A page on the specifically matched Vidow stream or cast paths can communicate with the injected bridge, which forwards a limited set of commands to extension code. The restriction to those Vidow URL patterns limits this path, but it still lets that website request selected privileged operations.
The bridge is injected only on app.vidow.io video/stream and video/cast paths. — manifest.json:40-44
The bridge listens for page messages and forwards permitted download, saved-video, HLS, and network-rule-related commands. — content_scripts/bridge.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The extension does not appear to rewrite referral codes, advertisements, shopping carts, or search results. It constructs Vidow service URLs with marketing parameters when opening the extension's own pages, but that is not modification of unrelated websites.
Adds UTM parameters to links opened to Vidow pages such as pricing, reviews, and dashboards; no page-link or ad replacement logic is shown. — assets/js/popup.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension modifies selected media request or response headers and can use temporary rules for video handling. It may also navigate a tab to a media URL in download fallback flows, but this is not evidence of a system-wide proxy or unrestricted browsing redirect.
The extension requests webRequest and declarativeNetRequest permissions and all host access. — manifest.json:23-31
The service worker inspects media requests and manages header-modification rules for media/download operations. — background/service_worker.js:1
Can it communicate with software on the computer or services running on localhost?
No native-messaging connection, localhost request, or direct operating-system process interface was found. The extension does communicate with remote Vidow services and uses the browser downloads API, which is not computer-software communication.
Uses BroadcastChannel and runtime messaging within the browser; no localhost or native-messaging endpoint is present. — content_scripts/bridge.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
It decodes and decrypts streaming media data, including AES-128 HLS segments, to inspect or process video streams. The reviewed code uses the decrypted data for media parsing and playback/download handling, not for executing scripts or injecting code.
Fetches AES-128 HLS keys and decrypts sampled media data with crypto.subtle.decrypt. — background/service_worker.js:1
Bundled HLS player contains AES decryption logic used when the player is initialized. — assets/js/hls-player.js:11-16
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites are not shown to receive broad privileged extension access, but the specifically matched Vidow stream and cast pages can use the injected bridge. That bridge exposes only its allowlisted operations, such as selected download, saved-video, HLS, and rule commands.
Only the specified app.vidow.io stream and cast paths receive the bridge script. — manifest.json:33-44
The bridge receives page messages and forwards a restricted set of extension commands. — content_scripts/bridge.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Feature behavior changes with the active website, login or premium state, blocked-site settings, cached results, device state, and server-provided limits. The bridge is also enabled only on specific Vidow stream or cast URLs.
Bridge activation depends on specific Vidow URL patterns. — manifest.json:33-44
Background logic checks site and account state and uses remote responses to determine feature behavior. — background/service_worker.js:1
Popup operations use device, limit, premium, and service-response state to gate features. — assets/js/popup.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining code or other concealed sustained heavy computation was found. Media parsing, decryption, thumbnail extraction, and video-size sampling are tied to the downloader's visible functions.
Background timers maintain caches and retry video-size requests; no mining or unexplained compute loop is shown. — background/service_worker.js:1
Does it change form fields or where a form sends its information?
The extension does not change form fields or form submission destinations. It reads page metadata and media URLs, then opens or downloads video resources.
DOM processing is limited to links, video/audio elements, metadata, JSON-LD, posters, and images; no form APIs or submit handlers are used. — content_scripts/content_script.js:1