Is "Video Speed Controller" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 75% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 46/100.
Evidence context: threat category none; evidence quality moderate.

This extension, named 'Video Speed Controller', declares a single sensitive permission: 'tabs' in manifest.json. For a video playback speed controller, the tabs permission is functionally necessary to inject speed control overlays into video pages across the browser. This is a standard pattern for legitimate video enhancement extensions and does not indicate malicious intent.

The network finding NET-FETCH-background.js-661 reports a fetch call in background.js at line 661. However, the finding does not specify any destination domain or URL. A single fetch call without associated suspicious domains is insufficient evidence of data exfiltration or command-and-control communication. Legitimate extensions commonly use fetch for update checks, configuration retrieval, or analytics.

Critically, this extension has zero malware signatures, zero obfuscation findings, zero IoCs, and zero code-smell findings. The absence of these high-confidence threat indicators is significant. Known malware patterns require either malware family signatures co-located with obfuscation, or specific suspicious domains in network findings. Neither condition is present here.

The strongest counterargument to this verdict is the developer's use of a generic Gmail address ([email protected]) combined with zero user count, which could indicate an anonymous publisher testing malicious code. However, anonymous publishing alone does not constitute evidence of malicious behavior. Many legitimate developers use personal email addresses for Chrome extensions, and new extensions naturally have zero users until they gain traction. Without specific evidence of harmful behavior—such as credential theft patterns, suspicious domains, or malware signatures—the Gmail address is a weak signal that does not override the absence of actual malicious indicators.

The extension's stated purpose (controlling HTML5 video playback speed) matches its manifest permissions and does not exhibit category mismatch. There is no evidence of typosquatting, as 'Video Speed Controller' is a generic descriptive name, not an imitation of a specific popular extension. The two medium-severity findings represent normal security scanner noise for this extension category, not actionable threats.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• Tabs permission is legitimate for video speed control functionality
• Network fetch finding lacks specific suspicious domain indicators
• Extension category matches declared functionality

False Positive Considerations

• Minimal findings (only 2 total) with no malware indicators
• Tabs permission is standard for video control extensions
• Network finding lacks specific domain evidence