Is Chrono Download Manager safe?
We analyzed Chrono Download Manager version 0.13.12's actual code and gave it a 5/100 trust score. This download manager has unusually broad access and…
Bottom line
This download manager has unusually broad access and can run vendor-supplied code with extension privileges.
What it can access
It can inspect pages across all websites, monitor network resources, manage downloads, read the clipboard, and access local download details—broader than a typical downloader needs. [Q1][Q3][Q5][Q18]
Security weaknesses
A vendor can replace an extension file with remotely supplied code that runs with the extension’s privileges, creating a critical control weakness. [Q16][Q20]
Signs of misuse
It sends usage information and may send complete download URLs containing sensitive data to the vendor, while also enabling remote control of privileged behavior. [Q6][Q14][Q20]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site host access plus downloads, download UI/open, webRequest, tabs, scripting, clipboard read/write, unlimited storage, offscreen documents, alarms, notifications, and context menus. Most support download management, but this is an exceptionally powerful combination.
Declares <all_urls> and the full set of download, network-observation, tab, scripting, clipboard, storage, and UI permissions. — manifest.json:1
Injects cs/main.js on top-level web/FTP pages and cs/sniffer.js in every matching frame. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It injects a full-screen download task dialog and download animation into pages. It can also replace visits to Chrome's downloads page with its own manager and hide Chrome's downloads shelf when configured.
Creates a fixed full-page wrapper/iframe for com/taskdlg.html and adds animated download indicators to the current document. — cs/main.js:1-8
Tab and setting handlers implement downloads-page override and chrome.downloads.setUiOptions shelf control. — bg/bg.min.js:117-265
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Its sniffer can enumerate links, images, audio, video, source, script, and stylesheet URLs plus nearby download/alt/title text from every frame. The scan is requested by the UI rather than uploaded automatically.
On g_links, walks document.links/images and audio, video, source, script, and link elements, returning their URLs and descriptive text. — cs/sniffer.js:1-5
Loads the sniffer on HTTP, HTTPS, and FTP pages with all_frames enabled. — manifest.json:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It observes active tab URLs and records visit counts for a hard-coded list of major media/social services. It also retains page/referrer URLs with download tasks, though it does not keep a general chronological page-history database.
Tab activation/update handlers pass URLs to a recognizer for YouTube, Vimeo, TikTok, Instagram, Facebook, Twitch, Reddit, Pinterest, Snapchat, and other services. — bg/bg.min.js:1-265
Download task records include URL, referer, page_title, text, title, and description and are persisted in IndexedDB. — bg/bg.min.js:1-265
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads clipboard text when the user starts a clipboard download, writes URLs to the clipboard, controls downloads, knows full local download paths, and can optionally work with file URLs. No camera, microphone, or screen capture was found.
Uses document.execCommand('paste') to obtain a clipboard URL and populate a new task. — com/taskdlg.min.js:1-87
Consumes chrome.downloads events and stores filename/full_path while implementing create, pause, resume, cancel, erase, open, and show operations. — bg/bg.min.js:1-265
Requests clipboardRead, clipboardWrite, downloads.open, and all-site access. — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends analytics through https://app.chronodownloader.net/ga.html. Data includes extension version, page/event names, settings and feature-use aggregates, download statistics, recognized service categories, errors, and in some failure cases a reversibly encoded full download URL.
Loads the vendor ga.html iframe and forwards queued gtag_event messages to it by postMessage. — bg/offscreen.min.js:1-5
Builds daily analytics from settings, storage quota, task/rule counts, file extensions, download sizes/statuses, and recognized site visits. — bg/bg.min.js:1-265
For failed range/HEAD checks, places an obfuscated but reversible form of the complete download URL in page_referrer. — bg/bg.min.js:1-265
Does it download or run code, settings, or instructions supplied by a remote server?
The vendor remotely supplies executable JavaScript, analytics/consent behavior, and promotion content. The JavaScript path is the most serious because it executes as part of privileged extension pages rather than merely displaying data.
Intercepts the extension URL for libs/z6Qm0b.js and substitutes WebAssembly-obtained JavaScript cached under a vendor URL. — bg/bg.min.js:1-265
Fetches remote promotion JSON and uses its URL/message/timing controls to show a manager-page promotion. — ui/ui.min.js:1-794
Vendor ga.html iframe supplies readiness and consent messages and receives telemetry events. — bg/offscreen.min.js:1-5
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Response-header monitoring, tab/service recognition, download event tracking, injected content listeners, daily telemetry, and remote script substitution run automatically after startup. Full page link enumeration is user-invoked.
Startup registers tab, download, webRequest, message, alarm, error, and install/update listeners and schedules daily telemetry. — bg/bg.min.js:1-265
Always records metadata for clicked link/media elements; the comprehensive g_links enumeration responds to a request. — cs/sniffer.js:1-5
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Uses chrome.downloads.setUiOptions and tab listeners to implement hide_cr_bar and override_cr settings. — bg/bg.min.js:1-265
Requests downloads.ui and tabs to support those changes. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Critical behavior is deliberately difficult to audit: the local script path and vendor cache key are encoded as integer arrays, a 93 KB WebAssembly module retrieves/transforms the replacement, and normal-looking packaged JavaScript is silently superseded at runtime.
Decodes integer arrays to 'libs/' and 'z6Qm0b.js', then routes the request through opaque JrgFEp7X.wasm exports. — bg/bg.min.js:1-265
Opaque compiled WebAssembly implements the network/payload transformation and exposes no reviewable source or endpoint string. — libs/JrgFEp7X.wasm:1
Packaged file appears to be an IndexedDB helper but is not necessarily the version executed because the service worker can replace its response. — libs/z6Qm0b.js:1-11
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The package exposes new Function() to its WebAssembly bridge and bundled SlickGrid code also compiles generated filter/aggregation strings with new Function(). More importantly, a remotely obtained JavaScript response is executed by ordinary script tags.
WebAssembly import __wbg_newnoargs creates new Function from a string supplied by the WASM module. — bg/bg.min.js:1-265
SlickGrid creates compiledAccumulatorLoop and compiledFilter functions from generated source strings. — ui/ui.min.js:1-794
Loads /libs/z6Qm0b.js as executable script, allowing the service-worker replacement to run. — ui/index.html:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Defines task records with URL, eurl, referer, description, page title, full_path, time fields, size, state, and errors and persists them in IndexedDB tasks-v2. — bg/bg.min.js:1-265
User-facing text describes importing downloads history from the browser. — _locales/en/messages.json:300-310
Does it create a persistent ID or browser fingerprint to recognize you?
It implements substantial vendor telemetry through a remote analytics iframe, with daily aggregation and per-feature/error events. No stable user ID was found in packaged code, but the remote iframe's implementation is outside the package.
Forwards telemetry to vendor-hosted ga.html as gtag_event messages. — bg/offscreen.min.js:1-5
Stores _glc_* counters and sends daily settings, environment, usage, service-category, and task aggregates. — bg/bg.min.js:1-265
Loads the same vendor iframe and provides a user-facing cookie/analytics consent interface. — ui/options.min.js:1-187
Does it send cookies, session details, authentication data, or page contents elsewhere?
Download URLs and referrers can contain signed links, tokens, or embedded credentials. Chrono stores them locally, and its failed range-support check may send the complete URL in a reversible custom encoding to analytics.
Persists full task URL, effective URL, and referer values. — bg/bg.min.js:1-265
Sb/cc transform a download URL with Base64-style reversible operations before od sends it as page_referrer after certain HEAD failures. — bg/bg.min.js:1-265
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Page listener tracks mouse location for download animation and handles fixed internal messages; it does not capture keystrokes or inputs. — cs/main.js:1-8
Reads resource/link metadata, not form field values. — cs/sniffer.js:1-5
Can a website or remote server send commands that make the extension take actions?
Vendor infrastructure can alter privileged executable behavior through the substituted JavaScript and alter promotions/analytics through remote documents. The package imposes no meaningful capability boundary on the replacement script.
Returns remote-derived code with application/javascript content type for an extension-origin script request and refreshes its cache after 20 hours. — bg/bg.min.js:1-265
Executes the substituted script in the manager extension page, where Chrome extension APIs and same-origin resources are available. — ui/index.html:1
Executes the same substituted path in the browser-action popup. — pop/pop.html:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Remote promotion renderer displays vendor-supplied message/link and adds utm_medium/utm_term parameters. — ui/ui.min.js:1-794
Only reads page resource links; it does not alter their href/src values. — cs/sniffer.js:1-5
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
A webRequest onHeadersReceived listener observes URL and selected response headers for almost every HTTP(S) resource type to identify media streams. It does not block or rewrite traffic in packaged code.
Registers onHeadersReceived for main/sub frames, scripts, XHR, images, media, WebSockets, and other resource types and reads content-type/length/disposition. — bg/bg.min.js:1-265
Requests webRequest and <all_urls>, but not declarativeNetRequest blocking rules. — manifest.json:1
Can it communicate with software on the computer or services running on localhost?
It handles full local download paths and, if the user grants Chrome's separate file-URL permission, can request file:// directory pages to implement its folder interface. It does not use native messaging or probe localhost/private networks.
Requests file:/// directory listings with XHR and parses generated addRow entries for folder navigation. — com/taskdlg.min.js:1-87
Tracks whether file-scheme access is granted and stores full paths received from chrome.downloads. — bg/bg.min.js:1-265
Requests no nativeMessaging permission. — manifest.json:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
It downloads or derives JavaScript from vendor infrastructure, disguises it as the packaged libs/z6Qm0b.js response, and causes popup/manager script tags to execute it with extension privileges. This is direct remote-code execution by design.
Fetch event handler intercepts chrome-extension://.../libs/z6Qm0b.js, obtains code via JrgFEp7X.wasm, returns it as application/javascript, and caches it under https://app.chronodownloader.net/js/z6Qm0b.js. — bg/bg.min.js:1-265
Includes /libs/z6Qm0b.js before ui/ui.min.js. — ui/index.html:1
Includes /libs/z6Qm0b.js before pop/pop.min.js. — pop/pop.html:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
externally_connectable permits only nimngehdfcodchaoncbkijfocmfnpebg and oflpkffadgbfbnjdckenekjbflgofalp. — manifest.json:1
onMessageExternal handles only open_ui and open_options/open_set commands. — bg/bg.min.js:1-265
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Runtime behavior is not fixed by the reviewed package because the vendor can replace a privileged script. It also treats selected media/social domains specially for analytics and wraps almost all event registration in a hard cutoff after June 30, 2027.
Remote script substitution can vary code independently of extension version. — bg/bg.min.js:1-265
Maps recognized site domains to analytics categories and only installs core listeners while Date.now() is at most 1814313675645 (2027-06-30 UTC). — bg/bg.min.js:1-265
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
It injects two scripts across all pages/frames, observes response headers for nearly every network resource, tracks all download events, maintains a large IndexedDB history, and runs analytics/remote iframe/code paths. This can impose significant continuous browser overhead.
Configures all-site content scripts, webRequest, unlimitedStorage, downloads, tabs, scripting, and offscreen access. — manifest.json:1
Startup registers global tab, window, download, webRequest, alarm, runtime, error, and update/install listeners. — bg/bg.min.js:1-265
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Page modification is limited to the extension dialog wrapper/iframe and download animation. — cs/main.js:1-8
Reads link/media metadata and sends fixed internal messages without changing host forms. — cs/sniffer.js:1-5