VideoPlayer MPD/M3U8/IPTV/EPG

Version 26.1.6.8388 View in Chrome Web Store

Last scanned: about 2 months ago | force re-scan

Extension Details

Developer: sharkiller.dev

Rating: 4.2 ★ (152 ratings)

Users: 300,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a substantial user base of 300,000 users and maintains a decent 4.2-star rating from 152 reviews, suggesting general user satisfaction. The specific focus on video streaming formats (MPD/M3U8/IPTV/EPG) indicates a legitimate use case for media consumption. The developer appears to specialize in media-related tools based on the naming convention.

Concerns: The primary concern is the broad host permissions that allow access to any website containing M3U and MPD files, which could potentially be exploited beyond the stated video streaming purpose. While the permissions are somewhat targeted to specific file types, they still grant extensive web access. The storage permission, while necessary for the extension's functionality to save user preferences and streaming data, adds another layer of data collection capability.

The extension's manifest version 3 compliance is positive for security, and the relatively focused permission set compared to similar media extensions is encouraging. However, the broad host permissions remain the main risk factor.

Recommendations: Consider running this extension in a separate Chrome profile if you frequently handle sensitive data while browsing. Monitor the extension's behavior and disable it when not actively streaming content. Regularly review what data the extension might be storing locally. Given the legitimate use case and reasonable user adoption, the risk appears manageable for users who need IPTV/streaming functionality.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

declarativeNetRequest
storage

Optional Permissions:

notifications

Host Permissions:

*://*/*.m3u*
*://*/*.mpd*
file:///*/*.m3u

Embedded URLs (80 total):

https://creativecommons.org/licenses/by-nc-nd/4.0/	https://example1.com/widevine
https://example2.com/widevine	https://github.com/shaka-project/shaka-player/issues/2759
https://bit.ly/2K9X1nY	https://mzl.la/2yCGWCm
https://sharkiller.dev/videoplayer/api/	https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=
https://sharkiller.dev/videoplayer/?utm_source=extension&utm_medium=about_iptv&utm_campaign=extension	http://www.w3.org/2000/svg
https://www.jwplayer.com/tos/	https://cdn.jwplayer.com/v2/media/
https://info.jwplayer.com/learn-more?e=	http://www.facebook.com/sharer/sharer.php?u=
http://x.com/intent/tweet?url=	https://www.linkedin.com/cws/share?url=
http://pinterest.com/pin/create/button/?url=	http://www.reddit.com/submit?url=
https://bsky.app/intent/compose?text=	https://wa.me/?text=
http://tumblr.com/widgets/share/tool?canonicalUrl=	https://schema.org
https://www.facebook.com/sharer/sharer.php?u=	https://x.com/intent/tweet?url=
https://pinterest.com/pin/create/button/?url=	https://www.reddit.com/submit?url=
https://tumblr.com/widgets/share/tool?canonicalUrl=	https://cdn.jwplayer.com/players/
https://developer.jwplayer.com/jw-player/docs/developer-guide/api/errors-reference#	https://gitlab.com/jwpconnatix/jwplayer/web-header-bidding#v7.10.1.jwplayer-analytics@https://gitlab.com/jwpconnatix/jwplayer/web-analytics#github-gitlab.plugin-gapro@mono
https://davidwalsh.name/detect-node-insertion	https://github.com/marcj/css-element-queries
https://momentjs.com/guides/#/warnings/define-locale/	https://momentjs.com/guides/#/warnings/js-date/
https://momentjs.com/guides/#/warnings/min-max/	https://momentjs.com/guides/#/warnings/add-inverted-param/
https://momentjs.com/guides/#/warnings/zone/	https://momentjs.com/guides/#/warnings/dst-shifted/
https://aomedia.org/emsg/ID3	http://www.w3.org/ns/ttml#styling
https://widevine-proxy.appspot.com/proxy	https://microsoft-proxy.appspot.com/proxy
https://developer.apple.com/streaming/emsg-id3	https://dashif.org/CPS
https://dashif.org/guidelines/clearKey	http://www.w3.org/1999/xlink
https://bit.ly/3clctcj	https://dashif.org/guidelines/trickmode
https://dashif.org/thumbnail_tile	https://dashif.org/guidelines/thumbnail_tile
https://dashif.org/guidelines/dash-if-uhd#hevc-hdr-pq10	http://www.w3.org/ns/ttml#parameter
http://www.w3.org/2006/10/ttaf1#parameter	http://www.w3.org/2006/10/ttaf1#styling
https://www.smpte-ra.org/schemas/2052-1/2010/smpte-tt	https://www.smpte-ra.org/schemas/2052-1/2013/smpte-tt
https://clients2.google.com/service/update2/crx	https://sharkiller.dev/videoplayer/
https://addons.mozilla.org/firefox/addon/videoplayer-mpd-m3u8-iptv-epg/	https://github.com/sharkiller/Reproductor-MPD-M3U8/wiki/Embed-player
https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=changelog&utm_campaign=extension	https://crowdin.com/project/reproductor-mpd
https://github.com/sharkiller	https://clearkeyserver.com/channel1.php
https://myserver.com/widevine	https://myserver.com/widevine/certificate
https://myserver.com/	https://myserver.com/tv/logos/channel1.png
https://myserver.com/tv/channel1.mpd	https://github.com/sharkiller/Reproductor-MPD-M3U8/wiki
https://chromewebstore.google.com/detail/opmeopcambhfimffbomjgemehjkbbmji/reviews	https://github.com/sharkiller/Reproductor-MPD-M3U8
https://discord.gg/q3eukAQtzp	https://t.me/videoplayer_iptv
https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=options&utm_campaign=extension	https://sharkiller.dev/videoplayer/?utm_source=extension&utm_medium=about_player&utm_campaign=extension
https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=settings&utm_campaign=extension#card-paypal	https://sharkiller.dev/videoplayer/subscribe/?utm_source=extension&utm_medium=settings&utm_campaign=extension#card-mercadopago
https://t.me/Sh4rkill3r	https://dash.akamaized.net/akamai/bbb_30fps/bbb_30fps.mpd

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAg5uoR2Nc2Mnho8gnRaf1u9boJ7vAVYRPbJj3GKK/nUUGoS0TqQvkX02E+TAE3Qv2tNuwyxyIXTKly1U+YgLremC6+PSrzwwjK7Gzx1cQyeKYaaNoneDQpozzlQsGSNwOpmdy6eiR7+IjsFXz45SmxPYjCFlNMtnKu3UhxqDmxpGG76I7uDUOAlBTK6TJF4GjL1murkQFuf5Wc0leEvCLYAEmGxpKYCjd+/LDlDWdtWPVeb3mySEbj4OUg+3xUC2p6MqnxDfIINoWSQIxhIruRiqJOQ0Wli9dnS9pjHfc+RNxxtInZ0FkoFryOBNG9u8eVbgynwyRQKRJfZjolIwnHwIDAQAB",
  "name": "__MSG_extension_name__",
  "icons": {
    "128": "play-on.png"
  },
  "action": {
    "default_icon": "play-on.png",
    "default_popup": "pages/options.html",
    "default_title": "__MSG_extension_name__"
  },
  "author": "Sharkiller",
  "version": "26.1.6.8388",
  "incognito": "split",
  "background": {
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "pages/settings.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extension_description__",
  "permissions": [
    "declarativeNetRequest",
    "storage"
  ],
  "default_locale": "en",
  "host_permissions": [
    "*://*/*.m3u*",
    "*://*/*.mpd*",
    "file:///*/*.m3u"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "notifications"
  ],
  "minimum_chrome_version": "100",
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "pages/player.html",
        "iptv/player.html",
        "play-on.png"
      ]
    }
  ]
}

by ✦ Astarte