Is rhwp - HWP Document Viewer & Editor safe?
We analyzed rhwp - HWP Document Viewer & Editor version 0.8.6's actual code and gave it a 55/100 trust score. Useful HWP features require broad access,…
Bottom line
Useful HWP features require broad access, but a serious network-validation flaw lowers confidence.
What it can access
It runs on every webpage, observes downloads, reads HWP-related page details, and can write clipboard content for its editor features.[Q1][Q2][Q4][Q5]
Security weaknesses
A website could potentially make automatic document requests reach internal network addresses because network checks do not verify the resolved address.[Q18]
Signs of misuse
No evidence shows tracking, credential collection, vendor uploading, remote commands, or hidden mining; requests support document viewing and rendering.[Q6][Q7][Q14][Q23]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs on all webpages and can monitor downloads, write to the clipboard, open tabs, add context menus, and store settings.
Declares an all-URLs content script and activeTab, downloads, contextMenus, clipboardWrite, storage, and all-URLs host access. — manifest.json:26-43
Which websites can it run on, and can it read or change what appears on those pages?
It scans every page for HWP links and reads limited link text and data-hwp metadata; no unrelated page-content collection was found.
Classifies anchor URLs and reads document title, size, page, author, date, category, description, format, and thumbnail attributes for its UI. — content-script.js:189-275,322-404,578-610
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Page reads are confined to HWP link URLs, labels, and explicitly prefixed metadata attributes. — content-script.js:189-275,322-404,578-610
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It observes browser downloads and stores its own settings and short-lived download state, but does not access history, bookmarks, cookies, passwords, or autofill.
Listens for download creation and changes and keeps per-download state in session storage. — sw/download-interceptor.js:44-89,163-229
Requests downloads and storage but none of the other browser-data permissions. — manifest.json:34-43
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads user-selected local documents and images, writes exported documents to downloads, and can copy editor content; no camera, microphone, or screenshot access exists.
Declares downloads, clipboardWrite, packaged parsers, fonts, and WebAssembly resources. — manifest.json:34-50
The viewer accepts local files, parses and edits them locally, and exports user-requested results. — assets/viewer-CKM21A5j.js:2
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends document GET requests to the document's own host and font GET requests to jsDelivr, but no document is uploaded to an extension-vendor server.
The viewer asks the worker to fetch the selected source URL when direct CORS fetch fails; bytes return only to the extension viewer. — sw/message-router.js:43-60
Performs a credential-free GET to the validated document URL and manually checks every redirect. — sw/fetch-security.js:96-118
Contains a fixed jsDelivr font catalog used for rendering when external fonts are enabled. — assets/viewer-CKM21A5j.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Settings are a fixed four-boolean schema loaded from Chrome sync and a local backup. — sw/settings-store.js:4-20,26-103
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
By default it scans all pages, prefetches thumbnails one second after load, and opens detected HWP downloads in a viewer; each behavior has a user setting where appropriate.
Badges and hover preview default true and thumbnail prefetch begins automatically with concurrency limited to three. — content-script.js:108-121,521-568
autoOpen, showBadges, and hoverPreview default to true. — sw/settings-store.js:15-20
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings or network-settings permission. — manifest.json:34-43
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive names, comments, explicit validation, and clear control flow. — content-script.js:1-611
Security policy is separated and documented in readable source. — sw/fetch-security.js:1-177
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Allows WebAssembly compilation and exposes only packaged wasm, fonts, icons, and the fixed developer helper. — manifest.json:44-50
Loads the packaged rhwp_bg WebAssembly asset from the extension bundle. — assets/viewer-CKM21A5j.js:2
Loads the packaged CanvasKit WebAssembly asset from the extension bundle. — assets/canvaskit-renderer-IcEzse5U.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Classifies anchor href values and queues qualifying document URLs. — content-script.js:189-275,521-568,578-610
Examines download URL and filename only for candidate HWP documents. — sw/download-interceptor.js:44-61,92-161
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Registers only lifecycle, menus, download interception, viewer, and message-routing features. — background.js:1-28
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Rejects URL userinfo and sets credentials to omit. — sw/fetch-security.js:77-87,96-104
Requests no cookies, identity, or webRequest permission. — manifest.json:34-43
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The webpage script handles link hover/click events and DOM mutations, not user input fields. — content-script.js:1-611
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Recognizes a fixed local message map for opening, fetching, thumbnail extraction, and settings. — sw/message-router.js:18-87
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It adds badges and preview cards next to HWP links and marks processed anchors; these visible changes support the advertised integration.
Creates extension-owned badge and closed-shadow preview elements next to qualifying links. — content-script.js:249-275,322-483,578-610
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It monitors HWP downloads and automatically fetches page-supplied document URLs for previews; hostname-only filtering leaves a blind DNS-rebinding SSRF path.
Automatically queues qualifying or data-hwp-marked links and asks the worker to fetch up to three thumbnails concurrently. — content-script.js:521-568
Accepts thumbnail URLs from any HTTP(S) content-script sender and passes them to the privileged extractor. — sw/message-router.js:63-78
Blocks literal private hosts and rechecks redirects, but validates only the hostname string and never verifies resolved IP addresses. — sw/fetch-security.js:60-118,125-176
Downloads the full response into an ArrayBuffer before enforcing only a 10 MB extracted-thumbnail output limit. — sw/thumbnail-extractor.js:21-52
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or external-program capability. — manifest.json:34-43
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains a fixed jsDelivr font catalog and loads fonts with FontFace for document layout. — assets/viewer-CKM21A5j.js:2
Exposes a user setting to disable external web fonts. — _locales/en/messages.json:36-41
Treats fetched document responses as byte arrays for the packaged parser. — sw/message-router.js:43-60
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Injects a fixed developer helper and announces version/capabilities, but does not listen for page commands. — content-script.js:124-136
rhwpDev only inspects and logs HWP links and metadata from the current DOM. — dev-tools-inject.js:1-155
Declares no externally_connectable entry. — manifest.json:1-56
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines four boolean controls and disables auto-open on unreadable or ambiguous settings state. — sw/settings-store.js:8-20,31-45,65-103
Loads and saves the four settings through the worker's shared settings store. — options.js:1-96
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Packaged WebAssembly and rendering code operate on opened documents. — assets/viewer-CKM21A5j.js:2
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Adds extension-owned link badges and preview cards without targeting forms or input values. — content-script.js:249-275,322-483,578-610