html-explainer-video

This is a browser-side film animation and playback utility, not evidence of malware. Its main security risk is DOM-based XSS if untrusted caption words reach drawCaps(), which inserts them into innerHTML; caller-supplied voice URLs also initiate media requests, and playback time is shared with the parent using target origin '*'. Severity is moderate and depends on whether these options can contain untrusted data; no suspicious domain, credential collection, or system-level behavior appears in the fragment.