Is Local Explorer - Open File Links in Chrome safe?
We analyzed Local Explorer - Open File Links in Chrome version 2026.4.10.0's actual code and gave it a 58/100 trust score. The feature is purpose-aligned,…
Bottom line
The feature is purpose-aligned, but its all-site reach and handoff of website-provided paths to desktop software create meaningful risk.
What it can access
It can inspect every website and hand file paths to desktop software, which exceeds narrow site access even though it supports the advertised feature.[Q1][Q2][Q5][Q19]
Security weaknesses
Website-provided links can trigger an unauthenticated local software handler, creating a risky bridge from untrusted pages to powerful local actions.[Q2][Q5][Q19]
Signs of misuse
It sends installation details to its vendor and lets a remote settings page affect behavior, but no sensitive browsing or account-data collection is shown.[Q6][Q7][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage plus host access and content-script injection on every URL. That is broader than necessary for corporate/local sites but enables its advertised job of finding file links anywhere the user browses.
Injects jQuery, SweetAlert, and content.js at document_start on <all_urls> and declares <all_urls> host permission. — manifest.json:14-31
Which websites can it run on, and can it read or change what appears on those pages?
It runs on every website, enumerates anchor elements, and rewrites each file:// href into a LocalExplorer: custom-protocol URL. It also changes links with targets to open in the same page.
Iterates over all anchors, recognizes file:// URLs, converts path syntax, assigns a LocalExplorer: href, and forces target to _self. — content.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
General-page processing is limited to anchor href and target properties; settings fields are handled only on the exact vnprodev options URL. — content.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests storage and host access but no cookies, history, bookmarks, or downloads permissions. — manifest.json:29-30
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
Through a separately installed desktop protocol handler, clicked links can open local files, folders, executables, mapped drives, and network shares. The extension itself does not read file contents and has no camera, microphone, location, clipboard, or nativeMessaging permission.
Converts drive, UNC, environment-variable, and relative file paths to LocalExplorer: URLs. — content.js:1
Documents local/network path examples and links to download the separate Integration Module. — options.html:30-42
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Install and some update events open vnprodev.com with browser/store and version information. The remote vnprodev options page receives the saved default folder path through shared page state when the page access fills its input; the page's own scripts can read that path.
Opens local-explorer-install.php with thanks/update, web-store, browser, and version query values. — background.js:1
Redirects settings to vnprodev's remote options page and writes the locally stored defaultFolder value into that page's DOM input. — options.js, content.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The options page UI is supplied by vnprodev.com after a successful availability check. Remote page content controls what the user sees and can supply default-folder and checkbox values that the fixed page access saves after the Save control is activated.
HEAD-checks the vendor options URL, navigates the extension options tab to it, and binds settings logic through the all-sites content script. — options.js:1
On the exact remote options URL, reads and writes fixed setting elements in the page DOM. — content.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically rewrites file links on every page and rescans dynamic pages after a custom page event when the Threads option is enabled. Installation and some version updates automatically open a vendor page.
Runs link rewriting at document readiness and debounces rescans triggered by a predictable extension-specific event. — content.js:1
Opens vendor install/update pages during selected runtime.onInstalled events. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
clickAllowFileAccess opens chrome://extensions or edge://extensions; no settings-management API is used. — background.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The small application files are minified onto single lines and the custom rescan event name is deliberately assembled from the extension ID, but the behavior remains readily traceable. Bundled jQuery and SweetAlert account for most code size; there is no encrypted data or dynamically unpacked application code.
Application code is compacted but uses readable API names, fixed URLs, and straightforward control flow. — background.js, content.js, options.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Generic legacy jQuery library includes globalEval support. — jquery.js:3
No application call site passes remote data to eval/globalEval or another executable-code sink. — background.js, content.js, options.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses location only to identify the vendor options page; general scanning processes file-link hrefs without logging or transmitting the containing page URL. — content.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It generates and stores a persistent UUID plus installation date, days installed, and last-active date. These values can recognize the local installation, but the reviewed package does not transmit the UUID or activity fields.
Creates uid and updates installdt, installdc, and last_active in chrome.storage.local. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission is declared. — manifest.json:29-30
Remote options integration exposes fixed preference values, chiefly defaultFolder, rather than session data. — content.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Click handler reads defaultFolder and three fixed checkboxes; no keylogging, clipboard read, capture, or general form listener is present. — content.js:1
Can a website or remote server send commands that make the extension take actions?
The vendor-controlled options page can influence extension settings by changing its fixed page fields and activating the Save control; it can also dispatch the predictable rescan event on any page to make the page access inspect links again. It cannot send arbitrary runtime messages or invoke a general privileged command services.
Trusts fixed DOM controls at the vendor options URL and listens for a derived custom document event that schedules link rescanning. — content.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
Its core feature alters file:// links on every website, replacing them with LocalExplorer: destinations and forcing targeted links to the same browsing context. It does not add referral codes, ads, or alter shopping/search results.
Rewrites qualifying anchor href and target attributes across all pages. — content.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It redirects clicked file links away from the browser's file: scheme to a LocalExplorer: custom protocol handled by desktop software. It does not intercept general HTTP traffic, change headers, manage downloads, or alter proxy settings.
Transforms local drive and UNC file URLs into custom-protocol destinations. — content.js:1
No webRequest, declarativeNetRequest, downloads, or proxy permission is declared. — manifest.json:29-30
Can it communicate with software on the computer or services running on localhost?
It communicates with separately installed software through the operating system's LocalExplorer: URL handler. The extension package does not use Chrome native messaging, authenticate the handler, or define what the external program does with supplied paths.
Creates LocalExplorer: links from website-provided file paths. — content.js:1
Provides a protocol test link and downloads a separate Windows Integration Module installer. — options.html:34-42
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Path normalization feeds only an anchor href with the LocalExplorer: scheme. — content.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Injects on all URLs. — manifest.json:14-20
Reads page-owned anchor hrefs and remote options DOM controls and listens for a document event. — content.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches on extension ID/store, debug install, stored options, install/update reason, and vendor URL. — content.js, background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
optThreads defaults to yes and schedules a full anchor scan one second after each extension-specific document event. — content.js:1
Does it change form fields or where a form sends its information?
On the vendor's remote options page, it fills and reads the default-folder field and checkboxes and saves them locally when the page's Save control is activated. It does not alter form destinations or fields on other websites; general pages only have file links rewritten.
Binds #btnSave and transfers #defaultFolder and three checkbox values between remote-page DOM and extension storage only at the exact vendor options URL. — content.js:1