Is Download with Free Download Manager (FDM) safe?
We analyzed Download with Free Download Manager (FDM) version 0.3.5's actual code and gave it a 58/100 trust score. This is a purpose-aligned FDM bridge,…
Bottom line
This is a purpose-aligned FDM bridge, but its native computer control, broad optional page access, and download interception create meaningful security risk.
What it can access
It can control downloads, send their details to local FDM software, launch a configured program, and optionally inspect pages across all websites; this broadly fits its purpose but is powerful. [Q1][Q4][Q5][Q18]
Security weaknesses
The exposed grab page lacks strong sender checks, while the separate computer helper cannot be audited from this package, creating meaningful misuse risk. [Q16][Q19][Q21]
Signs of misuse
No clear evidence shows spying, credential theft, deceptive changes, or unrelated collection; its data sharing is mainly download information for FDM, with limited lifecycle reporting. [Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests download control, native application messaging, active-tab and optional all-site page injection, context menus, storage, and notifications. Those capabilities fit an FDM bridge, but native process launch and interception of all browser downloads are high-impact permissions.
Declares nativeMessaging, downloads, activeTab, scripting, and optional *://*/* access. — manifest.json:permissions,optional_host_permissions
Builds command arguments and asks the native helper to execute a packaged child-process script. — worker.js:49-120
Registers or removes a listener that intercepts every newly created browser download. — worker.js:137-235
Which websites can it run on, and can it read or change what appears on those pages?
After the user grants optional all-site access, extension actions can inspect links, images, video sources, and selected content on any website and insert a full-page link-grabber iframe. No persistent page access runs automatically on ordinary pages.
Defines optional *://*/* host access rather than granting it initially. — manifest.json:optional_host_permissions
The link collector injects a function in all frames to enumerate image, media, and anchor URLs. — worker.js:254-267
Requests all-site permission for selection extraction and injects packaged link-grabber scripts into the chosen frame. — context.js:97-143
Adds an extension-origin grab interface over the current page. — data/grab/inject.js:9-32
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Collector returns only image src, video/source src, and anchor href values. — worker.js:254-265
Selection extraction reads anchor hrefs and regex-extracted URLs, not form inputs. — data/grab/selection.js:2-24
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
While enabled it receives every new download's URL, final URL, referrer, filename, MIME type, size, and ID, can pause the item, and erases its browser download record after native handoff. It does not request cookies, history, or bookmarks.
Reads download metadata, filters by settings, and pauses matching HTTP or FTP downloads. — worker.js:137-193
Erases the original Chrome download entry after execute() resolves. — worker.js:122-130
Requests downloads but not cookies, history, or bookmarks. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It communicates with software outside the browser through nativeMessaging and gives the helper path and child_process permissions. Its packaged host-side script launches the user-configured executable with constructed download arguments.
Declares nativeMessaging. — manifest.json:permissions
Sends the helper a packaged script, requested path/child_process permissions, executable, and arguments. — worker.js:91-103
Uses Node child_process.spawn to launch the configured executable as a detached process. — data/native.js:1-24
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Download URLs, referrers, filenames, and the browser user-agent are sent to the local native helper and then passed as arguments to Free Download Manager. The setup guide queries GitHub release metadata, and install/update/uninstall lifecycle fields go to the vendor homepage.
Substitutes URL, referrer, filename, destination path, and user-agent into native command arguments. — worker.js:60-103
Opens vendor lifecycle URLs containing extension version, previous version, and install/update/uninstall reason. — worker.js:271-295
Fetches the latest native-client release from GitHub when the user asks to download the helper. — data/guide-fdm/index.js:20-23,53-72
Does it download or run code, settings, or instructions supplied by a remote server?
The setup guide downloads a platform ZIP selected from GitHub's latest-release response after a user click. The extension does not automatically execute that archive; its runtime process-launch script is packaged locally and sent to the separately installed native helper.
Uses remote GitHub release metadata to choose and download windows.zip, mac.zip, or linux.zip. — data/guide-fdm/index.js:20-23,53-72
Reads /data/native.js from the installed package and sends that fixed text to the native host. — worker.js:91-97
The executed helper script is bundled source rather than downloaded server content. — data/native.js:1-24
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Once the user enables the extension, each matching new browser download is automatically paused and handed to FDM without another confirmation. The Chrome entry is erased when the native call succeeds—and also when a five-second fallback timer wins the race—so a stalled helper can leave the browser download paused while its record disappears.
Treats either the native response or a configurable fallback delay as the execute result; the fallback reports code 0. — worker.js:91-103
Erases the browser record whenever execute resolves without an error. — worker.js:122-130
Activates automatic download interception only after the user toggles the toolbar state on. — worker.js:137-235
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The extension source is readable, but its most powerful operation depends on the separately installed com.add0n.native_client host, whose implementation and security controls are not included. This package requests that host execute supplied JavaScript with filesystem-path and child-process capabilities.
Calls com.add0n.native_client with permissions, script text, and process arguments. — worker.js:91-103
Shows what this extension asks the host to run, but not how the host authorizes, isolates, or validates requests. — data/native.js:1-24
Queries the separately installed helper for its version. — data/guide-fdm/index.js:31-46
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads fixed packaged native.js text and passes it to the named helper. — worker.js:91-103
Uses child_process.spawn with shell mode absent and an explicit argv array. — data/native.js:10-14
Timers receive function callbacks, not code strings. — worker.js:46,98-103
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses the current tab for download context and executes link collection only through explicit extension messages. — worker.js:186-191,238-267
Caches extracted links per tab and invokes extraction from context-menu actions. — context.js:5-22,97-157
No general browsing beacon or visited-URL logger is present. — worker.js:271-295
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Reads and writes only downloader configuration and context-menu preferences. — data/options/index.js:44-96
Persists only the enabled toggle in the activation path. — worker.js:214-222
Does it send cookies, session details, authentication data, or page contents elsewhere?
It intentionally sends download URLs, final URLs, referrers, filenames, destination paths, and browser user-agent data to the local helper and FDM. Such URLs can contain signed or bearer-like query tokens.
Builds native arguments from download and page metadata, including URL, referrer, filename, path, and user-agent. — worker.js:60-103
Explicitly strips the --load-cookies=[COOKIES] argument because FDM cookie transfer is unsupported. — worker.js:75-76
Does not request cookies or webRequest/header-reading access. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
User clicks copy; calls navigator.clipboard.writeText with selected URL list. — data/grab/index.js:128-165
Can a website or remote server send commands that make the extension take actions?
A website can load the all-sites web-accessible grab page in a frame. That extension page automatically sends a link-collector message, and the worker trusts the sender and attempts to inject a collector into all frames of the containing tab.
Exposes data/grab/index.html to every website. — manifest.json:web_accessible_resources
Automatically sends extracted-links or link-collector to chrome.runtime when the exposed page loads. — data/grab/index.js:75-86
Handles link-collector using sender.tab and injects into all frames without checking sender.url, frame ancestry, or a nonce. — worker.js:238-267
User interaction in the frame can select links and send download jobs to the native handoff path. — data/grab/index.js:113-165
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Intercepts downloads.onCreated events; no DOM mutation or link rewriting. — worker.js:137-193
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
When enabled it changes browser download behavior by pausing matching downloads, launching them in FDM through the native helper, and erasing Chrome's download entry afterward. It does not alter general web traffic, proxy settings, or request headers.
Deletes the Chrome download record after native execution returns success. — worker.js:122-130
Observes every newly created download and pauses eligible HTTP/FTP items. — worker.js:137-193
Registers this interception only while the extension's user-controlled enabled state is on. — worker.js:196-235
Can it communicate with software on the computer or services running on localhost?
It communicates with the com.add0n.native_client process and asks it to run a supplied script with path and child-process permissions. That script spawns the configured Free Download Manager executable with download metadata as arguments.
Sends a native message containing requested permissions, packaged script text, executable, and argv. — worker.js:91-103
Expands an environment-variable path and starts the executable via child_process.spawn. — data/native.js:1-24
Lets the user configure the executable and argument template stored for future native launches. — data/options/index.js:22-42,70-96
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches a fixed extension-relative JavaScript file as text. — worker.js:91-97
The entire host-side process-launch script is readable in the package. — data/native.js:1-24
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary sites can embed the web-accessible grab page, which retains extension services access and immediately reaches the worker's privileged link-collection handler. The parent page is blocked by normal cross-origin rules from reading the frame's results directly, but the extension lacks a sender/nonce check and exposes a clickjackable path to link copying and native download actions.
Allows data/grab/index.html to be loaded from all URLs. — manifest.json:web_accessible_resources
Contacts the worker as soon as the page loads. — data/grab/index.js:75-86
Trusts the message's method and sender.tab without requiring that an extension-generated token or context-menu action created the page. — worker.js:238-267
Provides selectable Download and Copy controls with no frame-ancestor restriction or frame-busting logic. — data/grab/index.html:126-190
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines local enabled behavior, MIME filters, whitelist, delay, command, and context-menu settings. — data/options/index.js:44-96
Remote release lookup occurs only after a Download button click in the setup guide. — data/guide-fdm/index.js:48-77
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Full service-worker logic covers download interception, messaging, and lifecycle; no mining or heavy computation. — worker.js:1-295
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Collector reads only image, video/source, and anchor URLs. — worker.js:254-267
Extracts links from the current selection without reading form fields or submissions. — data/grab/selection.js:1-24
Adds and removes only the extension-owned grab iframe. — data/grab/inject.js:9-49