Is Chrome Downloads safe?
We analyzed Chrome Downloads version 1.2's actual code and gave it a 76/100 trust score. The extension has unnecessarily broad website access and mild…
Bottom line
The extension has unnecessarily broad website access and mild promotional or review-manipulation concerns, but no evidence of data theft or remote control.
What it can access
It requests download management and access covering every HTTP/HTTPS site, although reviewed code shows no page reading; this is broader than its folder shortcut needs. [Q1]
Security weaknesses
The unnecessary access covering every HTTP/HTTPS site could increase exposure if future code misuses it, but no current page-access weakness was found. [Q1]
Signs of misuse
It opens promotional pages during installation or removal and steers low ratings to private feedback instead of public reviews. [Q8] [Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests downloads permission and all HTTP/HTTPS host access. downloads is used only to reveal the default folder.
Declares downloads plus http://*/* and https://*/*; no content_scripts or scripting permission exists. — manifest.json:8-19
MainComponent calls only chrome.tabs.create for chrome://downloads and chrome.downloads.showDefaultFolder. — static/js/main.bef84b38.js:2
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines only a service worker and popup; content_scripts and scripting are absent. — manifest.json:8-19
First-party popup code contains only local UI and two Chrome shortcut actions. — static/js/main.bef84b38.js:2
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content script or scripting permission is declared. — manifest.json:8-19
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The sole downloads API call is chrome.downloads.showDefaultFolder(). — static/js/main.bef84b38.js:2
cookies, history and bookmarks permissions are absent. — manifest.json:11-17
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A visible popup button asks Chrome to show the user's default downloads folder. This does not enumerate or read files.
DownloadsFolder button maps directly to chrome.downloads.showDefaultFolder(). — static/js/main.bef84b38.js:2
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Only opens a fixed install page and registers a fixed uninstall URL. — background.js:1-16
Popup links contain no user-derived parameters and the bundle contains no network request API call. — static/js/main.bef84b38.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Worker contains fixed install/uninstall destinations and no network loader. — background.js:1-16
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Installation automatically opens a promotional Google Sites page, and uninstall directs Chrome to another fixed Google Sites page. Download-folder and downloads-page actions otherwise require explicit button clicks.
onInstalled opens chrdownloads; setUninstallURL records chrdownloads2. — background.js:1-16
Reviews routes 1–3 stars to chrdownloads3 and 4–5 stars to the store review page. — static/js/main.bef84b38.js:2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No override, settings, proxy or privacy permission is declared. — manifest.json:1-36
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Embeds readable Reviews.js, MainComponent.js, App.js and index.js source content. — static/js/main.bef84b38.js.map:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
reportWebVitals checks whether a callback is instanceof Function; index calls it without a callback, so the optional packaged chunk is not loaded. — static/js/main.bef84b38.js.map:1
Contains no eval() or Function constructor call. — static/js/main.bef84b38.js:2
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No content script, tabs/history permission or page-injection mechanism is declared. — manifest.json:8-19
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
storage permission is absent; first-party code contains no identifier generation or persistence. — manifest.json:11-17
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or website execution capability is present. — manifest.json:8-19
No network request code exists. — static/js/main.bef84b38.js:2
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Readable popup source contains only buttons and the rating widget. — static/js/main.bef84b38.js.map:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable, content script or messaging bridge is declared. — manifest.json:1-36
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The popup uses review gating: clicks corresponding to 1–3 stars open a private Google Sites feedback page, while 4–5 stars open the public Chrome Web Store review form. This manipulates where ratings are submitted but does not modify links or ads on visited websites.
Reviews.js binds the first three labels to openForm(chrdownloads3) and the last two to openReviews(the store listing). — static/js/main.bef84b38.js.map:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest or proxy permission is declared. — manifest.json:11-17
No chrome.downloads.download call exists. — static/js/main.bef84b38.js:2
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
nativeMessaging is absent and no local endpoint appears in the package. — manifest.json:1-36
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Source map accounts for the complete popup bundle as React runtime plus four small first-party components. — static/js/main.bef84b38.js.map:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable, content_scripts or web_accessible_resources declaration exists. — manifest.json:1-36
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches only on Chrome's standard installation reason; update branches are empty. — background.js:1-13
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Worker registers install/uninstall handling only. — background.js:1-16
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or scripting permission is declared. — manifest.json:8-19