Is Download Manager safe?
We analyzed Download Manager version 4.1.3's actual code and gave it a 88/100 trust score. This appears to be a purpose-aligned download manager with…
Bottom line
This appears to be a purpose-aligned download manager with meaningful local-file control but no established abuse.
What it can access
It can inspect download details, open files, reveal them in the file manager, and delete them, which fits its purpose but affects local files.[Q1][Q3][Q18][Q19]
Security weaknesses
No evidence shows websites or remote servers can control it, and it does not run downloaded code or expose privileged messaging.[Q7][Q16][Q21]
Signs of misuse
No download data, browsing data, cookies, or page contents are sent elsewhere; the only identified outside requests load donation images.[Q6][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests full download-management access, permission to open downloaded files and control the download shelf, storage, side-panel access, and optional notifications. These powers are appropriate for a download manager but can affect local files.
Declares downloads, downloads.open, downloads.shelf, storage, sidePanel, and optional notifications. — manifest.json:permissions and optional_permissions
Uses the permissions to inspect and manage download records and files. — background.js:download item actions
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts and requests no scripting or host access. — manifest.json:top-level fields
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads download filenames, original URLs, received and total bytes, resumability, errors, completion times, pause state, and whether local files exist. It can also permanently delete a completed downloaded file after the user presses Delete file.
Calls chrome.downloads.search and maps filename, URL, byte, canResume, error, endTime, paused, and exists fields. — background.js:Download model and search
Uses chrome.downloads.removeFile for the visible Delete file action. — background.js:getPrimaryAction
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores appearance, shelf, and notification preferences in sync storage and a local map of active/recent download IDs to states for badges and notifications. It does not store file contents.
Reads sync preferences and stores download ID/state pairs in local storage. — background.js:storage listeners, p, w, L, and I
Persists theme, icon colors, shelf visibility, and notification event switches. — assets/options-b1e5e6a1.js:settings component
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can request browser notification permission and display filename, progress context, status, and action buttons for download events. It does not use camera, microphone, screen capture, location, or other sensors.
Creates optional basic notifications for started, paused, resumed, error, and complete states. — background.js:notification class and u
Requests or removes notification permission based on explicit settings. — assets/options-b1e5e6a1.js:notification settings
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No download data is transmitted. The options page loads two static donation-button images from cdn.ko-fi.com, which exposes a normal request containing network metadata but no filename, URL, or file content.
References https://cdn.ko-fi.com/cdn/kofi1.png and kofi5.png as remote images. — assets/options-b1e5e6a1.js:settings header markup
Contains no fetch, XHR, beacon, websocket, or developer endpoint. — background.js:network review
Reads and manages downloads locally without remote submission. — assets/popup-7a0e8734.js:popup application
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
References packaged HTML and JavaScript entry points. — manifest.json:background, action, options_page, and side_panel
No code-download or remote execution path was found. — *.js:network and execution review
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically watches download changes, updates local status/badges, and optionally shows notifications. Opening, revealing, pausing, resuming, canceling, retrying, clearing, and deleting occur through visible item controls.
Refreshes status on download changes/erasures and derives notifications automatically. — background.js:downloads and storage listeners
Binds each management operation to a labeled button or file row click. — assets/popup-7a0e8734.js:Download actions
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Calls chrome.downloads.setShelfEnabled with the stored showShelf value. — background.js:L
Exposes the shelf behavior as a labeled settings checkbox. — assets/options-b1e5e6a1.js:showShelf control
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The Svelte output is minified and bundled but small and straightforward, with identifiable browser calls and literal labels. This is normal production bundling rather than strong concealment.
Roughly 6 KB minified service worker with readable API calls and action labels. — background.js:entire file
Roughly 10 KB minified popup bundle with traceable download operations. — assets/popup-7a0e8734.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All behavior uses packaged functions and normal API callbacks. — *.js:dynamic-code review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Calls chrome.downloads.search ordered by most recent start time and retains URL/name/status data. — background.js:S
Searches and filters recent downloads for display in the popup/side panel. — assets/popup-7a0e8734.js:Ie and We
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Storage holds preferences and download ID/state pairs only; no telemetry submission exists. — *.js:network and storage review
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or website host access. — manifest.json:permissions
Reads the Chrome download item's URL only for local display/retry actions. — background.js:Download model
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no clipboard, content-script, capture, or sensor permission. — manifest.json:permissions
Passes the user's query only to chrome.downloads.search. — assets/popup-7a0e8734.js:search input
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Builds behavior from packaged logic, Chrome download state, and sync settings. — background.js:f, p, w, L, and I
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Defines no content scripts or host permissions. — manifest.json:top-level fields
Displays an explicit Buy Me a Coffee link to ko-fi.com. — assets/options-b1e5e6a1.js:settings header
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It does not intercept network traffic, but it can control download operations: start a retry from the stored URL, pause, resume, cancel, erase history, open/reveal files, or delete the file. Each operation is a user-facing manager action.
Calls chrome.downloads.open, show, resume, pause, removeFile, download, cancel, and erase. — background.js:Download.open, getPrimaryAction, getSecondaryAction, and getOpenInFolderAction
Declares downloads and downloads.open but not webRequest, declarativeNetRequest, proxy, or debugger. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
It can ask Chrome to open a downloaded file with the operating system's associated application or reveal it in the file manager. It does not use native messaging or issue arbitrary local commands.
Uses chrome.downloads.open or chrome.downloads.show for completed items. — background.js:Download.open and getOpenInFolderAction
Declares downloads.open but no nativeMessaging permission. — manifest.json:permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
No decoded value flows into a code-execution sink. — *.js:decoder and execution review
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable declaration. — manifest.json:top-level fields
No runtime.onMessage or onMessageExternal handler was found. — *.js:message listener review
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches on local download state and stored UI preferences. — background.js:storage and download listeners
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Work is limited to download queries, state mapping, icon drawing, badge updates, and UI rendering. — *.js:computation review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines no content scripts and requests no website access. — manifest.json:top-level fields