Is Video Download Helper safe?
We analyzed Video Download Helper version 10.6.7.2's actual code and gave it a 55/100 trust score. Video downloading is the stated purpose, but the…
Bottom line
Video downloading is the stated purpose, but the extension combines broad website access, telemetry, and purpose-limited remote code evaluation with substantial review uncertainty.
What it can access
The extension requests access across all websites and can monitor or modify selected requests, inject page code, and create downloads [Q2][Q8][Q18]. These capabilities support video downloading, but the broad scope and powerful browser controls exceed what a narrowly limited site feature would need.
Security weaknesses
Remote or page-supplied text can be turned into executable code for media processing [Q11]. Supported pages can also influence privileged extension operations, while message validation was not fully established [Q16][Q21].
Signs of misuse
The extension sends page URLs, media details, and technical information in diagnostic reports [Q6][Q12]. No evidence shows theft of passwords, cookies, or page contents, but remote settings can change behavior across websites [Q14][Q22].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests broad access across websites and powerful download, request-monitoring, page-injection, storage, and browser-control capabilities. These are broadly consistent with downloading videos, but the scope is wider than necessary for a narrowly limited video site.
The manifest requests <all_urls>, tabs, downloads, webRequest, declarativeNetRequest, scripting, webNavigation, storage, unlimitedStorage, offscreen, sidePanel, notifications, and contextMenus, plus optional browsing-data and download-open — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: <all_urls> — manifest.json:1
Content scripts run directly on: *://*.youtube.com/*, *://*.youtube.com/*, *://*.vimeo.com/*, *://*.vimeo.com/*, *://*.facebook.com/*, *://*.instagram.com/*, *://*.ok.ru/*, *://*.m.ok.ru/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The reviewed code does not establish that passwords, payment details, messages, or arbitrary form entries are collected or sent elsewhere. YouTube reads its own page cookie for media requests, but that is not evidence of typed-data logging.
The YouTube scanner incorporates document.cookie into a YouTube media-session object; no password, payment, message, or form-field collection is established. — injected/youtube.js:113
Content scripts are limited to listed sites and do not by themselves prove collection of sensitive fields. — manifest.json:44-205
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension has broad request and tab permissions, but the reviewed runtime does not establish that it reads stored cookies, browsing history, bookmarks, or download history. Optional browsing-data access is used for clearing data, not demonstrated extraction.
The manifest lists tabs, webRequest, webNavigation, and optional browsingData, but not cookies, history, or bookmarks permissions. — manifest.json:7-27
The history UI requests optional browsing-data capability for clearing behavior; this does not establish reading private browser records. — content/history.js:48
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends diagnostic reports outside the browser, including the page URL, event type, media details, platform, user agent, extension version, and language. Other runtime paths contact media or extension services for downloading and detection.
The diagnostic POST includes page_url, event type, timestamp, media type, details, platform, user agent, extension version, and language. — content/history.js:34
The panel contains a corresponding diagnostic-report path. — content/panel.js:46
Another extension UI path sends the diagnostic structure to a remote endpoint. — content/register_components.js:29
Does it download or run code, settings, or instructions supplied by a remote server?
The extension downloads remote media and evaluates JavaScript text derived from remote YouTube player code to decipher media URLs. This is purpose-limited processing, not evidence that arbitrary remote extension code is installed.
YouTube player-script-derived text is passed through an evaluation shim for signature transformation. — injected/youtube.js:73
The service worker receives code in a qjs message and evaluates it in an embedded QuickJS context. — service/main.js:52
The download worker fetches and processes remote media resources. — download_worker/main.js:6-9
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Beyond displaying controls, the extension monitors matching traffic, polls some site endpoints, modifies selected request headers, and can fetch or create downloads. Some operations require user interaction, while site-specific detection can run automatically when a matching page is open.
The extension has downloads, webRequest, declarativeNetRequest, tabs, and related capabilities. — manifest.json:7-16
The worker installs media-related header rules and handles request-driven media processing. — service/main.js:18,24,52
The Chaturbate script periodically polls a stream endpoint. — injected/chaturbate.js:9
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the package contains very large bundled files, embedded WebAssembly, MAIN-world scripts, and dynamic evaluation. This increases review difficulty, although size or minification alone does not prove malicious behavior.
This roughly one-million-byte bundled script includes complex media logic and dynamic evaluation. — injected/youtube.js:1-113
This roughly 1.4 MB bundled artifact is difficult to review manually. — content/smartnaming.js:1-6
The service worker is a large bundled runtime containing media, networking, and QuickJS-related logic. — service/main.js:1-52
Multiple MAIN-world and isolated scripts execute on external sites. — manifest.json:44-205
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The extension evaluates text as JavaScript: YouTube deciphering uses player-script-derived code, and the service worker evaluates code in an embedded QuickJS runtime. This does not by itself show unrestricted execution in the extension's main JavaScript realm.
The YouTube path evaluates player-script-derived text through an eval shim. — injected/youtube.js:73
The service includes QuickJS evalCode functionality and evaluates code received in the qjs path. — service/main.js:8,52
The extension-page CSP permits wasm-unsafe-eval. — manifest.json:18-19
Does it track the websites, pages, searches, or links you visit?
The extension records or transmits page URLs and media activity in diagnostic reports, so it can track visited pages in those reporting contexts. The evidence supports download troubleshooting and media detection, not continuous advertising-style profiling of every visit.
Diagnostic reports include page_url, event type, timestamp, media type, and media details. — content/history.js:34-36
The panel sends corresponding page and media telemetry. — content/panel.js:46
The worker observes requests for media detection, but observation alone is not treated as tracking without a storage or transmission path. — service/main.js:52
Does it create a persistent ID or browser fingerprint to recognize you?
The extension creates random UUIDs for downloads and temporary request IDs. It also uses a remote player ID when available, but the code does not clearly show that this is a cross-site browser fingerprint.
Download/request objects use crypto.randomUUID(). — service/main.js:24
YouTube handling passes a remote_behaviours.gyt_scanner.player_id into its session configuration. — injected/youtube.js:113
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends page and media diagnostics, but the reviewed code does not establish that it sends cookies, authentication tokens, or page contents to a third party. YouTube's cookie use is for constructing a same-site media request, not demonstrated cookie theft.
document.cookie is placed into a YouTube session object used by the media scanner; no external-cookie exfiltration sink is shown. — injected/youtube.js:113
Diagnostic payloads contain page and technical metadata, not cookies or page contents. — content/history.js:34
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records typing, form entries, or screenshots. Clipboard use is limited to writing links or information when the user invokes a copy action.
navigator.clipboard.writeText is used to copy an extension-generated URL or information. — content/history.js:36,48
Can a website or remote server send commands that make the extension take actions?
A supported website can send messages that cause the extension to process media, apply media-related request rules, or evaluate deciphering code. Remote configuration also changes site-specific behavior, but the reviewed evidence does not show unrestricted arbitrary privileged commands.
The service worker handles injected messages, media operations, request rules, and qjs evaluation. — service/main.js:24,52
YouTube injected code sends media and deciphering-related messages to the extension service. — injected/youtube.js:78,113
Remote behaviors and experiments are refreshed and used by runtime logic. — service/main.js:52
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The extension extracts media URLs and can carry or strip URL parameters for download handling. I found no demonstrated alteration of advertising, referral codes, shopping carts, or search results.
Website-specific parameter handling is used for media URL processing. — service/main.js:24
Download arguments preserve or construct media URLs rather than modifying shopping or search pages. — content/history.js:36
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension observes web requests and installs declarative rules that modify selected media-related request headers. The reviewed evidence does not show proxy-setting changes or arbitrary redirection of all traffic.
The extension requests webRequest and declarativeNetRequest permissions. — manifest.json:15-18
Runtime rules use modifyHeaders for matching XMLHttpRequests. — service/main.js:18
The worker observes request/response activity and manages media-related handling. — service/main.js:24,52
Can it communicate with software on the computer or services running on localhost?
No active connection to localhost or native computer software was found. The large smart-naming bundle contains unrelated keyword strings, which is insufficient to demonstrate such communication.
A keyword list contains listenOnLocalhost, but no demonstrated localhost connection or native-messaging implementation was found. — content/smartnaming.js:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension decrypts or decodes media data and separately executes JavaScript used for media deciphering. The evidence does not show that decrypted user data is then executed as code; these are distinct processing paths.
The download worker uses cryptographic decryption for media processing. — download_worker/main.js:9
The service evaluates supplied code in QuickJS. — service/main.js:8,52
YouTube signature code is evaluated for media URL transformation. — injected/youtube.js:73
The page-world script handles encoded media playlist data. — injected/xgplayer_crypto_untrusted.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Named sites' MAIN-world scripts can relay page-controlled data to isolated extension code, which then communicates with the service worker. The available evidence does not fully establish the message validation and origin checks needed to decide whether an ordinary page can invoke broader privileged features.
MAIN-world scripts are restricted to specific site patterns rather than all ordinary websites. — manifest.json:44-205
The page-world YouTube script relays data through BroadcastChannel. — injected/youtube_untrusted.js:1
The service worker processes messages from injected contexts. — service/main.js:24
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior varies by website and remote configuration: site-specific scripts, persisted remote behaviors, and experiments control media handling. Some premium or account-related pages also use stored extension state, so activation depends on runtime context.
Website-specific behavior and remotely refreshed experiments influence runtime handling. — service/main.js:24,52
Remote website behavior maps and experiment data are persisted and used by extension UI/runtime logic. — content/details.js:6,34
Premium-page code reads persistent installation and download-related state. — injected/premium.js:34
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining loop or mining service was demonstrated. WebAssembly and media conversion are present for video processing, not shown as hidden background mining.
The worker uses WebAssembly and media-processing code for downloads and conversion. — download_worker/main.js:1,9
The crypto-named injected files are restricted to specific video sites and are associated with playlist decoding. — manifest.json:266-278
Does it change form fields or where a form sends its information?
No evidence was found that it changes form fields or submits forms to different destinations. Its observed page modifications concern media detection and download support.
Content scripts target listed media sites and the extension's own activation or premium pages. — manifest.json:44-281
The input listener synchronizes an extension UI text area, not a webpage form submission. — content/smartnaming.js:85