Top Risks

• webRequest + <all_urls>: intercepts all browser traffic across every site visited.
• Content scripts injected on *://*/* give broad DOM access to every page.
• Developer name absent in listing; identity relies solely on email domain vidow.io.
• Description promises download but lacks 'downloads' permission — minor mismatch.
• Privacy policy collects data with third-party sharing status silent (third_party_silence=true).

Evidence

• verified_publisher + featured_by_google store Extension holds both verified publisher and Featured badges; reduces reputation risk.
• broad_host_access_with_webRequest manifest host_permissions=[<all_urls>] combined with webRequest; justified-broad discount applied for VideoDownloader.
• content_scripts_all_urls manifest content_scripts_matches includes *://*/* — injects on every page, wide surface.
• cve_findings_raw_empty crx No CVEs detected in bundled libraries; CVE pillar = 0.
• code_findings_raw_empty crx No malicious code patterns found; obfuscation_score=0.0.
• privacy_policy_classification api Policy fetched, scoped to extension, data_collection=true, retention=true, third_party_sharing=false but third_party_silence=true.
• description_promise_mismatch store Promises download but lacks 'downloads' permission; is_shell_pattern=false.
• threat_intel_clean api No bad_host_hits, affiliate_hits, or monetization_hits; developer domain resolves, not throwaway.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; needed for video detection.
• webRequest high Intercepts all network requests; core for detecting video streams but broad capability.
• declarativeNetRequest medium Can block/modify requests declaratively; lower risk than webRequestBlocking.
• storage low Local state storage; minimal risk.
• <all_urls> (host_permission) high Broad host access paired with webRequest; justified for video downloader category.
• content_scripts *://*/* high Injects scripts on all pages; expected for video detection but wide surface.

Pillar Scores

Bookkeeping