Is DW File Manager safe?
We analyzed DW File Manager version 1.0's actual code and gave it a 86/100 trust score. DW File Manager appears purpose-aligned and low concern, with only…
Bottom line
DW File Manager appears purpose-aligned and low concern, with only a minor preview display weakness.
What it can access
It requests no browser or website access and reads files only from a folder you explicitly choose, matching its file-management purpose. [Q1][Q5]
Security weaknesses
A selected file name is inserted into preview markup without escaping, creating a possible display-injection weakness, although code execution was not shown. [Q3]
Signs of misuse
No evidence shows outside data transfers, downloaded instructions, unsolicited actions, or collection of cookies, sessions, or page contents. [Q6][Q7][Q8][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It opens its own file-manager page and requests no browser permissions or website access.
Declares only an action and packaged background worker, with no permissions or host_permissions. — manifest.json:1-24
The toolbar click opens the packaged filemanager.html page. — background.js:1-5
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, scripting permission, activeTab, or host access. — manifest.json:1-24
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
A selected video's local file name is inserted into generated HTML without escaping; markup injection is possible, but active code execution was not demonstrated.
Interpolates value.name into the title of a document.write template used for video preview. — filemanager.js:52-68
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Keeps the selected File objects and directory tree only in page memory. — filemanager.js:8-23
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read names and contents only from a folder the user explicitly selects, then preview or open those files locally.
Provides a visible webkitdirectory file input. — filemanager.html:27-42
Builds an in-memory tree and uses blob URLs for selected file previews. — filemanager.js:14-38,48-88
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Only opens a packaged page. — background.js:1-5
Contains no fetch, XHR, WebSocket, beacon, form submission, or remote endpoint. — filemanager.js:1-218
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All behavior is packaged and local. — filemanager.js:1-218
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Runs only when the toolbar action is clicked. — background.js:1-5
Folder access begins only after the file input changes. — filemanager.js:14-23
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings permissions. — manifest.json:1-24
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive functions and straightforward DOM code. — filemanager.js:1-218
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses ordinary event handlers and DOM APIs only. — filemanager.js:1-218
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no tabs, history, webNavigation, or host permissions. — manifest.json:1-24
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no identifier generation or analytics code. — filemanager.js:1-218
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or website access. — manifest.json:1-24
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Keyboard handlers only navigate the local file list. — filemanager.js:188-211
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable interface or network access. — manifest.json:1-24
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or scripting access. — manifest.json:1-24
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Uses local File and blob URL APIs without network requests. — filemanager.js:1-218
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or host permissions. — manifest.json:1-24
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads only packaged CSS and JavaScript. — filemanager.html:21-43
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares neither content scripts nor externally_connectable origins. — manifest.json:1-24
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Actions are bound to explicit UI and keyboard events. — filemanager.js:14-25,128-133,188-211
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Only builds a directory tree and renders file previews. — filemanager.js:1-218
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
It cannot inject into external pages. — manifest.json:1-24