[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

VideoPlayer MPD/M3U8/IPTV/EPG

Version 26.1.6.8388 View in Chrome Web Store

Last scanned: about 19 hours ago

Extension Details

Developer: sharkiller.dev

Rating: 4.1 ★ (167 ratings)

Users: 300,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a substantial user base of 300,000 users and maintains a decent rating of 4.1 stars, suggesting general user satisfaction. The developer appears to specialize in video player functionality based on the name "sharkiller.dev". The extension's purpose is clearly defined for handling specific video formats (MPD/M3U8/IPTV/EPG).

Concerns: The primary concern is the broad host permissions that allow access to M3U and MPD files across all websites. While these permissions align with the extension's video player functionality, they create potential attack vectors for data interception or unauthorized access to streaming content. The storage permission, though standard for media players that need to save preferences or cache data, adds another layer of data handling that requires trust in the developer.

The extension's access to file:// URLs is particularly noteworthy as it can read local video files, which could potentially be misused to access other local content.

Recommendations: Consider running this extension in a separate Chrome profile if you frequently handle sensitive streaming content or have concerns about privacy. Regularly review what data the extension might be storing locally. Monitor your network activity when using the extension to ensure it's only accessing legitimate video streams. Given the specialized nature of video streaming, this extension is likely necessary for users who work with these specific formats, but standard privacy precautions should be maintained.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

declarativeNetRequest
storage

Optional Permissions:

notifications

Host Permissions:

*://*/*.m3u*
*://*/*.mpd*
file:///*/*.m3u

Embedded URLs (80 total):

https://creativecommons.org/licenses/by-nc-nd/4.0/	https://example1.com/widevine
https://example2.com/widevine	https://github.com/shaka-project/shaka-player/issues/2759
https://bit.ly/2K9X1nY	https://mzl.la/2yCGWCm
https://sharkiller.dev/videoplayer/api/	https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=
https://sharkiller.dev/videoplayer/?utm_source=extension&utm_medium=about_iptv&utm_campaign=extension	http://www.w3.org/2000/svg
https://www.jwplayer.com/tos/	https://cdn.jwplayer.com/v2/media/
https://info.jwplayer.com/learn-more?e=	http://www.facebook.com/sharer/sharer.php?u=
http://x.com/intent/tweet?url=	https://www.linkedin.com/cws/share?url=
http://pinterest.com/pin/create/button/?url=	http://www.reddit.com/submit?url=
https://bsky.app/intent/compose?text=	https://wa.me/?text=
http://tumblr.com/widgets/share/tool?canonicalUrl=	https://schema.org
https://www.facebook.com/sharer/sharer.php?u=	https://x.com/intent/tweet?url=
https://pinterest.com/pin/create/button/?url=	https://www.reddit.com/submit?url=
https://tumblr.com/widgets/share/tool?canonicalUrl=	https://cdn.jwplayer.com/players/
https://developer.jwplayer.com/jw-player/docs/developer-guide/api/errors-reference#	https://gitlab.com/jwpconnatix/jwplayer/web-header-bidding#v7.10.1.jwplayer-analytics@https://gitlab.com/jwpconnatix/jwplayer/web-analytics#github-gitlab.plugin-gapro@mono
https://davidwalsh.name/detect-node-insertion	https://github.com/marcj/css-element-queries
https://momentjs.com/guides/#/warnings/define-locale/	https://momentjs.com/guides/#/warnings/js-date/
https://momentjs.com/guides/#/warnings/min-max/	https://momentjs.com/guides/#/warnings/add-inverted-param/
https://momentjs.com/guides/#/warnings/zone/	https://momentjs.com/guides/#/warnings/dst-shifted/
https://aomedia.org/emsg/ID3	http://www.w3.org/ns/ttml#styling
https://widevine-proxy.appspot.com/proxy	https://microsoft-proxy.appspot.com/proxy
https://developer.apple.com/streaming/emsg-id3	https://dashif.org/CPS
https://dashif.org/guidelines/clearKey	http://www.w3.org/1999/xlink
https://bit.ly/3clctcj	https://dashif.org/guidelines/trickmode
https://dashif.org/thumbnail_tile	https://dashif.org/guidelines/thumbnail_tile
https://dashif.org/guidelines/dash-if-uhd#hevc-hdr-pq10	http://www.w3.org/ns/ttml#parameter
http://www.w3.org/2006/10/ttaf1#parameter	http://www.w3.org/2006/10/ttaf1#styling
https://www.smpte-ra.org/schemas/2052-1/2010/smpte-tt	https://www.smpte-ra.org/schemas/2052-1/2013/smpte-tt
https://clients2.google.com/service/update2/crx	https://sharkiller.dev/videoplayer/
https://addons.mozilla.org/firefox/addon/videoplayer-mpd-m3u8-iptv-epg/	https://github.com/sharkiller/Reproductor-MPD-M3U8/wiki/Embed-player
https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=changelog&utm_campaign=extension	https://crowdin.com/project/reproductor-mpd
https://github.com/sharkiller	https://clearkeyserver.com/channel1.php
https://myserver.com/widevine	https://myserver.com/widevine/certificate
https://myserver.com/	https://myserver.com/tv/logos/channel1.png
https://myserver.com/tv/channel1.mpd	https://github.com/sharkiller/Reproductor-MPD-M3U8/wiki
https://chromewebstore.google.com/detail/opmeopcambhfimffbomjgemehjkbbmji/reviews	https://github.com/sharkiller/Reproductor-MPD-M3U8
https://discord.gg/q3eukAQtzp	https://t.me/videoplayer_iptv
https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=options&utm_campaign=extension	https://sharkiller.dev/videoplayer/?utm_source=extension&utm_medium=about_player&utm_campaign=extension
https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=settings&utm_campaign=extension#card-paypal	https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=settings&utm_campaign=extension#card-mercadopago
https://t.me/Sh4rkill3r	https://dash.akamaized.net/akamai/bbb_30fps/bbb_30fps.mpd

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAg5uoR2Nc2Mnho8gnRaf1u9boJ7vAVYRPbJj3GKK/nUUGoS0TqQvkX02E+TAE3Qv2tNuwyxyIXTKly1U+YgLremC6+PSrzwwjK7Gzx1cQyeKYaaNoneDQpozzlQsGSNwOpmdy6eiR7+IjsFXz45SmxPYjCFlNMtnKu3UhxqDmxpGG76I7uDUOAlBTK6TJF4GjL1murkQFuf5Wc0leEvCLYAEmGxpKYCjd+/LDlDWdtWPVeb3mySEbj4OUg+3xUC2p6MqnxDfIINoWSQIxhIruRiqJOQ0Wli9dnS9pjHfc+RNxxtInZ0FkoFryOBNG9u8eVbgynwyRQKRJfZjolIwnHwIDAQAB",
  "name": "__MSG_extension_name__",
  "icons": {
    "128": "play-on.png"
  },
  "action": {
    "default_icon": "play-on.png",
    "default_popup": "pages/options.html",
    "default_title": "__MSG_extension_name__"
  },
  "author": "Sharkiller",
  "version": "26.1.6.8388",
  "incognito": "split",
  "background": {
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "pages/settings.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extension_description__",
  "permissions": [
    "declarativeNetRequest",
    "storage"
  ],
  "default_locale": "en",
  "host_permissions": [
    "*://*/*.m3u*",
    "*://*/*.mpd*",
    "file:///*/*.m3u"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "notifications"
  ],
  "minimum_chrome_version": "100",
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "pages/player.html",
        "iptv/player.html",
        "play-on.png"
      ]
    }
  ]
}

by ✦ Astarte