Is Telegram Video Downloader - TVDownloader safe to use?

Telegram Video Downloader - TVDownloader has a risk level of MEDIUM with an overall risk score of 4.4/10. Our scan detected 58 security findings. This extension has some risks worth reviewing.

What permissions does Telegram Video Downloader - TVDownloader request?

Telegram Video Downloader - TVDownloader requests the following permissions: storage, tabs. It also requests host access to: https://*.telegram.org/*.

What is Telegram Video Downloader - TVDownloader's risk score?

Telegram Video Downloader - TVDownloader has an overall risk score of 4.4/10 (MEDIUM). Breakdown: Permissions 6.0/10, Code 6.8/10, Combinations 0.0/10, CSP 5.0/10.

ExtSafe

Telegram Video Downloader - TVDownloaderSecurity Analysis

Chromev1.3.0MV3March 16, 2026 at 03:53 PM

Use with caution

This extension requests significant permissions. It has 50K+ users, a 4.9 star rating, but review the findings below.

4.4MEDIUM

4.4 MEDIUMRaw: 4.9

This extension shows some risk signals that are common in legitimate extensions but worth reviewing. Check the details below.

Based on 3 permissions including high-risk ones, 56 code findings.

Trust Signals(3.0/10)

Users

50K

Rating

4.9(745 reviews)

Status

Featured

Permissions

6.0/10

Code

6.8/10

Combinations

0.0/10

Manifest/CSP

5.0/10

Permissions(3 analyzed)

Code Findings(8 patterns, 56 total)

Libraries(5 detected)

5 libraries detected

Content Security Policy

No CSP Defined(1 issue)

MEDIUM

N/ANo CSP defined

This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.

Manifest Analysis(2 findings)

Resolved from __MSG_* i18n placeholders:

Name: Telegram Video Downloader - TVDownloader

Description: Telegram Content downloader: Restricted videos/images with a single click. (Telegram Movie Downloader)

HIGH

web_accessible_resourcesJS files exposed to web pages

JavaScript files are accessible to ALL websites. Any page can load and interact with these scripts, enabling web→extension attacks.

MEDIUM

web_accessible_resources.matchesOverly broad match patterns

Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.

External Domains(12)

chromewebstore.google.comgithub.comjedwatson.github.iolodash.commicrosoftedge.microsoft.comnpms.ioopenjsf.orgreactjs.orgt.metvdownloader.comunderscorejs.orgwebk.telegram.org