Is Video Downloader Ultimate - Free Video Downloader safe?
We analyzed Video Downloader Ultimate - Free Video Downloader version 1.4.4's actual code and gave it a 38/100 trust score. This downloader has unusually…
Bottom line
This downloader has unusually broad access, tracks browsing by default, and contains a website-to-download security weakness.
What it can access
It can run on every website, inspect traffic, alter selected provider requests, store provider authentication data, and download files beyond a narrow downloader need [Q1][Q2][Q4].
Security weaknesses
A TikTok page can trigger an extension-powered download without a matching user request because the message bridge lacks adequate request validation [Q16][Q21].
Signs of misuse
The extension sends visited destinations, referrers, timing details, and a persistent ID to its server by default, enabling browsing-history tracking [Q6][Q12][Q13].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests access to every website, can inspect page content, observe web traffic, change selected provider requests, store provider authentication-related data, and download files; this broadly exceeds what a narrowly scoped video-downloader needs.
Requests downloads, storage, webRequest, and declarativeNetRequest permissions, with access to *://*/* and content scripts running on every matching site. — manifest.json:1
Stores complete matching X request headers in extension storage. — scripts/service_worker.js:12752-12760
Stores Facebook authentication-related request tokens. — scripts/service_worker.js:12886-12899
Changes selected Instagram and TikTok request headers. — scripts/service_worker.js:12902-12967
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*/* — manifest.json:1
Content scripts run directly on: *://*/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Its page access runs on every website and can read page content, including form fields. The reviewed behavior does not currently copy passwords, payment fields, messages, or typed form values.
Loads the content script at document_start on every HTTP and HTTPS website. — manifest.json:23-37
The active code selects provider-specific page readers by hostname; no form-value collection was found. — scripts/content.js:12724-12846
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension reads Facebook’s visible c_user cookie, captures Facebook dtsg tokens, and stores complete matching X services request headers that may contain Authorization and CSRF values. It uses the downloads services, but no direct bookmarks or history services access was established.
Reads the requested cookie name from document.cookie on Facebook pages. — scripts/content.js:11433-11436
Stores complete requestHeaders for matching X API requests in chrome.storage.local.twitter. — scripts/service_worker.js:12752-12760
Extracts fb_dtsg_ag from Facebook request URLs and stores the token. — scripts/service_worker.js:12886-12899
Invokes chrome.downloads.download for supplied download data. — scripts/service_worker.js:12682-12690
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
By default, it sends each completed top-level destination URL, referrer, timestamp, response type and status, foreground state, and a persistent user ID to lola.ultimate-vdownloader.com. This is browsing-history-like collection, not merely crash reporting.
Configures the vendor-controlled Sentry destination and explicitly retains handleLoad and handleReject events. — scripts/service_worker.js:12233-12248
Registers listeners for top-level traffic across all HTTP and HTTPS URLs. — scripts/service_worker.js:12741-12749
Builds events containing destination URL, referrer, timestamp, persistent ID, request type, content type, status, and foreground state. — scripts/service_worker.js:13017-13081
Sends those events by default unless the user has explicitly disabled autolog. — scripts/service_worker.js:13135-13152
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Declarative rules loaded from local rules.json; no remote rule source — manifest.json:38-46
update_url is the standard Google CRX update endpoint — manifest.json:3
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It reports browsing activity automatically without a per-visit user action. On TikTok, page scripts can also send a forged helper message that the extension turns into a browser download.
Broad traffic listeners activate during service-worker initialization. — scripts/service_worker.js:12741-12749
Forwards any matching TT_DOWNLOAD_BLOB window message to the service worker without authenticating the page sender. — scripts/content.js:12027-12039
Downloads the supplied blob URL and filename when that message arrives. — scripts/service_worker.js:12686-12690
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The three main runtime files are large minified bundles, which makes independent review unnecessarily difficult. The important navigation tracking and download-message paths were still directly traceable.
A roughly 647 KB bundled content script mixes application and library code. — scripts/content.js:1-12853
A roughly 632 KB bundled worker includes the extension logic and a large Sentry library. — scripts/service_worker.js:1-13180
A roughly 946 KB bundled popup includes application and third-party library code. — scripts/popup.js:1-19755
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The new Function fallback is bypassed whenever globalThis exists and does not consume remote input. — scripts/service_worker.js:42-48
Contains the same non-remote bundler fallback. — scripts/popup.js:6658-6664
Does it track the websites, pages, searches, or links you visit?
It tracks every completed or failed top-level HTTP and HTTPS visit and sends the destination, referrer, timing and response details, foreground status, and persistent installation ID to the vendor by default.
Observes top-level requests across all HTTP and HTTPS URLs. — scripts/service_worker.js:12741-12749
Correlates and packages destination, referrer, timestamps, response data, foreground state, and a persistent ID. — scripts/service_worker.js:13017-13124
Sends the package through the vendor's Sentry client by default. — scripts/service_worker.js:13135-13152
Defaults collection on and presents the setting only as Automatic error reporting. — scripts/popup.js:6942-6948,7080-7096
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a random installation ID, saves it indefinitely in extension storage, and attaches it to browsing events sent to the vendor, allowing visits to be linked over time.
Creates and persistently stores a UUID-like identifier. — scripts/service_worker.js:12970-13007
Adds that identifier to each completed-navigation telemetry event. — scripts/service_worker.js:13063-13081
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Stores X request headers locally and reuses selected values only in an api.x.com request. — scripts/service_worker.js:12752-12803
Stores a Facebook request token locally for later Facebook requests. — scripts/service_worker.js:12886-12899
Uses Facebook's visible c_user cookie in a request back to facebook.com. — scripts/content.js:11393-11436
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Can a website or remote server send commands that make the extension take actions?
Any script running on a TikTok page can forge the extension's unauthenticated window message and make the extension download a supplied blob and filename. The path is limited to TikTok pages and the browser's Downloads area.
Accepts TT_DOWNLOAD_BLOB from the shared page window without a nonce, origin secret, or request correlation check. — scripts/content.js:12027-12039
Uses the forwarded filename and blob URL in chrome.downloads.download. — scripts/service_worker.js:12686-12690
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension modifies selected Instagram, VK, and TikTok request or response headers through declarative and dynamic rules, and it invokes the downloads services for media files. No proxy-setting change or general navigation redirect was established.
Packaged rules modify Instagram request headers and VK response CORS headers. — rules.json:3-68
Dynamic rules rewrite Instagram and TikTok request headers. — scripts/service_worker.js:12902-12967
Message handlers invoke downloads.download for video or blob downloads. — scripts/service_worker.js:12682-12690
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Entire 2.4 KB file is a TikTok fetch/XHR observer and blob downloader; no decoding or obfuscation. — scripts/helper.js:1-59
Entire 2.5 KB file reads React fiber internals from video elements and writes a URL to a DOM attribute. — scripts/story.js:1-38
Can ordinary websites access privileged extension features through messaging or exposed files?
TikTok page scripts can reach the privileged download handler through an unauthenticated window-message bridge. Merely exposing all packaged files is not itself privileged access, but this concrete bridge is reachable.
Injects helper.js and forwards page-window download messages into extension messaging. — scripts/content.js:12018-12039
The privileged worker performs the download without validating a corresponding extension request. — scripts/service_worker.js:12686-12690
All packaged resources are exposed to every matching website, unnecessarily broadening the page-facing surface. — manifest.json:57-65
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Registers telemetry listeners for all HTTP and HTTPS top-level traffic. — scripts/service_worker.js:12741-12749
Selects media-provider behavior by the current hostname. — scripts/content.js:12724-12846
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.