Extension Details
Context-Aware Verdict
The extension has a substantial user base of 300,000 users and maintains a high rating of 4.8 stars from 2,200 reviews, suggesting general user satisfaction. However, the developer "qooly.com" lacks detailed information about their company background or reputation, which limits trust assessment. The extension's purpose as a video downloader is legitimate and commonly sought after.
The extension's permission set is extremely broad and concerning for its stated purpose. The combination of webRequest interception, universal host permissions, and content script injection creates a powerful surveillance and data collection capability that far exceeds what's necessary for video downloading. The ability to intercept all web requests across all websites could enable credential theft, session hijacking, or comprehensive browsing surveillance. The downloads permission, while relevant to the core function, combined with other permissions creates additional attack vectors.
Given the critical risk level, avoid installing this extension on your primary browser profile. If you must use it, create a dedicated Chrome profile specifically for video downloading activities and avoid logging into sensitive accounts while using it. Consider alternative video downloaders with more restrictive permissions, or use standalone software solutions instead. Monitor your download folder for unexpected files and review your browsing data regularly if you choose to proceed with installation.
Findings
Security Analysis Details
Required Permissions:
- storage
- tabs
- webRequest
- downloads
- declarativeNetRequest
Host Permissions:
- <all_urls>
Embedded URLs (21 total):
| http://www.w3.org/1999/xlink | http://www.w3.org/2000/svg | |
| http://www.w3.org/1998/Math/MathML | https://github.com/facebook/regenerator/blob/main/LICENSE | |
| https://player.vimeo.com/video/ | https://www.instagram.com/graphql/query/?query_hash=55a3c4bad29e4e20c20ff4cdfd80f5b4&variables= | |
| https://www.instagram.com/api/v1/media/ | https://www.instagram.com/api/v1/feed/reels_media/?reel_ids=highlight%3A | |
| https://www.instagram.com/api/v1/users/web_profile_info/?username= | https://www.instagram.com/api/v1/feed/reels_media/?reel_ids= | |
| https://api.twitter.com/2/timeline/conversation/ | https://qooly.com/contact-us | |
| https://qooly.com/how-to-use | https://www.facebook.com/video/video_data_async/?video_id= | |
| https://vk.com/video_ext.php?oid= | https://vk.com/al_video.php?act=show_inline&al=1&video= | |
| https://www.dailymotion.com/player/metadata/video/ | https://www.tiktok.com/@ | |
| https://api.twitter.com/oauth2/token | https://www.bilibili.com | |
| https://clients2.google.com/service/update2/crx |
Raw Manifest
{ "name": "__MSG_name__", "icons": { "32": "32.png", "64": "64.png", "128": "128.png" }, "action": { "default_popup": "popup.html", "default_title": "__MSG_title__" }, "version": "1.14", "background": { "service_worker": "worker.js" }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "__MSG_desc__", "permissions": [ "storage", "tabs", "webRequest", "downloads", "declarativeNetRequest" ], "default_locale": "en", "content_scripts": [ { "js": [ "inject.js" ], "run_at": "document_start", "matches": [ "<all_urls>" ], "all_frames": true, "exclude_matches": [ "*://www.youtube.com/*", "*://qooly.com/*", "*://*.globo.com/*" ] } ], "host_permissions": [ "<all_urls>" ], "manifest_version": 3, "web_accessible_resources": [ { "matches": [ "<all_urls>" ], "resources": [ "*" ] } ] }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.