Top Risks

• webRequest + <all_urls> + content_scripts on all URLs: broad interception capability on every site visited.
• jQuery 3.2.1 bundled with 3 moderate CVEs (XSS); no CSP amplifies DOM-sink risk.
• Developer email is free webmail (gmail) with no verified business identity; no developer name listed.
• Privacy policy admits data collection and third-party sharing but no retention period disclosed.
• No last_updated date available; maintenance posture unknown.

Evidence

• webRequest + <all_urls> host_permissions + content_scripts <all_urls> manifest High-capability combo: intercept all requests AND inject into all pages. Justified for VideoDownloader but high residual risk.
• jquery@3.2.1 with 3 moderate CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023) crx Vulnerable jQuery in DOM-manipulation lib; no CSP present on MV3 extension amplifies XSS surface.
• No CSP declared (csp_present=false, content_security_policy=null) manifest MV3 has strict default for service workers but no explicit CSP; combined with vulnerable jQuery raises risk.
• function_constructor in background.js, content-sidebar.js, content.js crx new Function() constructor detected in 3 JS files; pattern consistent with minified lib bootstrap but warrants review.
• Developer email: beschwartz396@gmail.com; developer_name empty store Free webmail address, no developer name; verified_publisher=true and is_featured_by_google=true partially offset.
• Privacy policy: data_collection=true, third_party_sharing=true, retention=false, scope_extension=true api Policy scoped to extension and acknowledges 3rd-party sharing but omits retention period.
• months_since_update=null; last_updated empty store Cannot confirm recency; scored as 6-12 month bracket for conservative maintenance estimate.
• verified_publisher=true AND is_featured_by_google=true store Both badges present; apply reputation discounts but cap limited by free-webmail dev and missing developer name.

CVE Exposures (3)

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• tabs medium Can read tab URLs and titles; moderate privacy risk.
• webRequest high Intercepts all network requests; core to video detection but high-impact.
• downloads medium Can initiate file downloads; matches stated function.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• <all_urls> (host_permissions) high Content scripts injected on all sites; broad reach amplifies other permissions.

Pillar Scores

Scoring History

Bookkeeping