Is One-click image downloader - Grabit safe?
We analyzed One-click image downloader - Grabit version 4.0.2's actual code and gave it a 68/100 trust score. A useful downloader with unusually broad…
Bottom line
A useful downloader with unusually broad website access and limited, consent-based data sharing, but no clear evidence of abusive intent.
What it can access
It runs across all websites and can inspect media, download files, open temporary tabs, and alter limited requests, which is broad for a downloader.[Q1][Q2][Q5][Q18]
Security weaknesses
Page-controlled messages can imitate media information, while a remote setting can disable selected features, though neither directly grants arbitrary downloads or commands.[Q16][Q21]
Signs of misuse
It sends quota data and, only with consent, usage details and site names; no evidence shows tracking, manipulation, hidden work, or form tampering.[Q6][Q12][Q22][Q24]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can run on every HTTP and HTTPS page and has tabs, scripting, downloads, storage, offscreen, alarms, and request-modification access; this is broad but fits a universal media downloader.
Declares all-page isolated and main-world scripts, all-site host access, downloads, tabs, scripting, storage, offscreen, and declarative network permissions. — manifest.json:28-54
Which websites can it run on, and can it read or change what appears on those pages?
It scans page elements and styles for media and, on supported sites, inspects selected fetch/XHR response bodies to discover original images and videos.
The bundled content logic walks page media, injects download controls, and maintains media candidate caches. — content_script.js:1
Host-gated bridges wrap fetch and XMLHttpRequest on supported sites and parse bounded response bodies for media metadata. — main_world_bridge.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can observe media metadata from authenticated social feeds, including X, Instagram, and OnlyFans, but the reviewed logic extracts media URLs rather than forms, private messages, or typed text.
Parses supported timeline, post, story, and OnlyFans API responses into media URL records. — main_world_bridge.js:1
Receives those records for local media discovery and download UI. — content_script.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores per-site settings, download preferences, quota counters, account state, analytics consent, and random service identifiers in Chrome storage.
Maintains local and sync state for preferences, domain rules, quotas, authentication, review prompts, and optional analytics. — background_script.js:1
Stores the user's analytics consent choice in sync storage. — onboarding/setup.js:42-61
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It downloads images and videos, creates temporary tabs for some fallback retrievals, and uses offscreen processing to fetch or convert media.
Requests downloads, tabs, scripting, and offscreen permissions. — manifest.json:40-49
Coordinates Chrome downloads, media fetch fallbacks, and temporary resolver tabs. — background_script.js:1
Fetches media blobs and converts image formats in the offscreen document. — offscreen.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends anonymous quota counters to Grabit's cloud service; with explicit consent it also sends usage events, error context, relevant hostnames, and random client/session IDs. Media downloads go directly to their source hosts.
Calls freeQuotaStatus/freeQuotaConsume, analyticsGateway, and clientSiteErrorReport; analytics and site-error reporting check analyticsConsent before sending. — background_script.js:1
Discloses optional event, error, and hostname collection and states that URL paths, image URLs, filenames, names, emails, and payment details are excluded. — _locales/en/messages.json:2385-2428
Does it download or run code, settings, or instructions supplied by a remote server?
It fetches a Grabit-hosted Pixiv kill-switch document that can disable specific Pixiv features; no general remote instruction system was demonstrated.
Fetches https://grabitdl.com/extension-config/pixiv-kill-switch.json and normalizes a fixed set of boolean disable flags. — background_script.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The all-page scripts start automatically, scan for media, and install host-specific response observers; uploads are limited to quota traffic and consent-gated analytics or errors.
Loads isolated and main-world scripts at document_start on all HTTP and HTTPS pages. — manifest.json:28-43
Automatically installs bounded fetch/XHR hooks only on recognized media sites. — main_world_bridge.js:1
Optional analytics checks stored consent before queuing and sending events. — background_script.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, search-provider, homepage, management, or browser-settings permission. — manifest.json:40-54
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Minified bundle exposes named Shopify-free Grabit services, endpoint paths, payload fields, and validation logic. — background_script.js:1
Identifies bundled third-party software and licensing. — third-party-notices.txt:1-10
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The only new Function occurrence evaluates the fixed literal 'return this' for global-object detection. — background_script.js:1
The Function occurrences are equivalent fixed global-object fallbacks in bundled libraries. — content_script.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses window.location and current-page scope to select media resolvers and per-domain settings. — content_script.js:1
Reads active/source tab URLs for downloads, temporary resolver tabs, diagnostics, and review prompts. — background_script.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates persistent random identifiers for anonymous quota enforcement and optional analytics. Consent-gated analytics can include site hostnames but excludes full page paths and image URLs by design.
Builds anonymousLocalId, analytics_client_id, and session IDs; gates analytics and clientSiteErrorReport on analyticsConsent. — background_script.js:1
Explains the optional hostname collection and excluded URL and personal fields. — _locales/en/messages.json:2385-2428
Does it send cookies, session details, authentication data, or page contents elsewhere?
Some media fetches use the user's existing session with the source site, and optional Grabit Pro authentication uses Firebase tokens. The extension does not request the cookies permission or expose credentials to an unrelated domain.
Authenticated Instagram/media fallbacks use credentials include only with intended source-site endpoints; Pro status uses Firebase/Grabit service tokens. — background_script.js:1
Does not request the cookies permission. — manifest.json:40-54
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Page processing is centered on media elements, layout, media metadata, and download controls. — content_script.js:1
Requests no capture, camera, microphone, or clipboard-read permission. — manifest.json:40-49
Can a website or remote server send commands that make the extension take actions?
A remote kill switch can disable selected Pixiv behaviors, but it cannot supply selectors, scripts, or arbitrary commands in the reviewed implementation.
Maps the remote document into a fixed set of Pixiv disable booleans and otherwise fails open. — background_script.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates page-level download controls and extension UI near detected media. — content_script.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It fetches arbitrary media URLs selected from webpages, saves files, opens temporary resolver tabs, and modifies Referer headers for Pixiv image hosts. It does not configure a browser proxy.
Validates and downloads media candidates and uses temporary hidden tabs for bounded fallbacks. — background_script.js:1
Fetches media with size, timeout, content-type, and conversion checks. — offscreen.js:1
Sets the Referer header to pixiv.net only for two Pixiv image host patterns and media request types. — dnr_rules.json:1-34
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission; file creation is handled through Chrome's downloads API. — manifest.json:40-49
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses the Pixiv kill switch and Grabit service responses as fixed schemas. — background_script.js:1
Parses supported-site JSON responses into bounded media records without evaluating response text. — main_world_bridge.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Host-specific main-world bridges exchange media metadata through window.postMessage without a secret, so page scripts can imitate messages. The accepted data is schema-checked and feeds media selection rather than directly invoking a download.
Uses fixed source/type labels and host checks for X, Instagram, OnlyFans, and gallery bridge messages. — main_world_bridge.js:1
Accepts matching media batches and resolution responses into local caches; downloads remain separate user-driven actions. — content_script.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Provides user controls for domain rules, download behavior, language, analytics, and account status. — options.js:1
Requires an explicit choice to enable or disable optional analytics during onboarding. — onboarding/setup.js:42-61
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background computation is tied to media resolution, downloads, account/quota checks, analytics, and image handling. — background_script.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
DOM mutations implement media buttons, overlays, dialogs, and progress UI; no form-action redirection path was found. — content_script.js:1