[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

MyJDownloader Browser Extension

Version 3.3.20 View in Chrome Web Store

Last scanned: about 10 hours ago

Extension Details

Rating: 3.3 ★ (601 ratings)

Users: 500,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has a substantial user base of 500,000 users, which suggests some level of community acceptance. However, the relatively low rating of 3.3 out of 5 stars from 601 reviews raises concerns about user satisfaction and potential issues. The lack of clear developer information and company details significantly undermines trust and accountability.

Concerns:

The extension's permission set is extremely broad and concerning for a download manager. The combination of webRequest and webRequestBlocking permissions with all_urls access creates a powerful surveillance and interception capability that extends far beyond what's necessary for managing downloads. The ability to inject content scripts into every website visited poses significant privacy and security risks. The extension can potentially monitor all web traffic, modify requests, steal credentials, and access sensitive data across all websites. The use of the older Manifest V2 also indicates weaker security protections.

Recommendations:

Given the critical risk level, strongly consider running this extension in a completely separate Chrome profile isolated from your main browsing activities. Only use this profile for download-related tasks and avoid accessing sensitive websites like banking or email. Alternatively, consider switching to standalone download managers or browser-native download features. If you must use this extension, regularly audit your download history and monitor for unusual network activity. Keep the extension updated and consider uninstalling it when not actively needed for downloads.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Dangerous Permission Combination: webRequest + webRequestBlocking

This extension can intercept, modify, and block web requests in real-time. This combination could be used to modify sensitive web traffic or steal data.

HIGH

High-Risk Permission: <all_urls>

This extension has the <all_urls> permission. Can access all websites and their content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequestBlocking

This extension has the webRequestBlocking permission. Can block and modify web requests in real-time. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

tabs
storage
webRequest
webRequestBlocking
contextMenus
<all_urls>

Embedded URLs (340 total):

https://support.jdownloader.org	https://www.google.com/recaptcha/enterprise.js?render=explicit
https://www.google.com/recaptcha/api.js?render=explicit	https://hcaptcha.com/1/api.js?render=explicit
https://my.jdownloader.org	http://my.jdownloader.org:8000
http://browsehappy.com/	https://clients2.google.com/service/update2/crx
http://my.jdownloader.org/	https://my.jdownloader.org/
https://my.jdownloader.org/login.html#forgotPassword?email=	https://my.jdownloader.org/login.html?register
http://jdownloader.org/impressum	https://my.jdownloader.org/legal/privacy.html
https://my.jdownloader.org/legal/terms.html	http://support.jdownloader.org
https://my.jdownloader.org/?deviceId=	https://support.jdownloader.org/index.php?/Knowledgebase/Article/View/42/0/JD-opens-my-browser-to-display-captchas
https://board.jdownloader.org/showthread.php?t=76515	https://dummycnl.jdownloader.org/#
https://bugzilla.mozilla.org/show_bug.cgi?id=1408446	https://chrome.google.com/webstore/
http://127.0.0.1/	http://127.0.0.1:9666/flash/addcrypted2?fromExtension
http://127.0.0.1:9666/flash/add?fromExtension	https://api.jdownloader.org
http://stackoverflow.com/questions/11219582/how-to-detect-my-browser-version-and-operating-system-using-javascript	https://getbootstrap.com/
https://github.com/twbs/bootstrap/blob/master/LICENSE	https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
http://fontawesome.io	http://fontawesome.io/license
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://angularjs.org
http://caniuse.com/#search=transition	https://www.owasp.org/index.php/SameSite
http://www.ietf.org/rfc/rfc2109.txt	http://en.wikipedia.org/wiki/Representational_State_Transfer
http://example.com:8080/api	http://example.com/resource.json
http://example.com/:id.json	http://example.com/resource/:resource_id.:format
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials	https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/responseType
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify#toJSON%28%29_behavior	http://url.com/id/.format?q=x
http://url.com/id.format?q=x	http://server.com/index.html#/Chapter/1/Section/2?search=moby
https://rawgit.com/w3c/html/html5.1-2/single-page.html#void-elements	http://dev.w3.org/html5/spec/Overview.html#semantics
http://simon.html5.org/html-elements	http://dev.w3.org/html5/spec/Overview.html#void-elements
http://dev.w3.org/html5/spec/Overview.html#optional-tags	https://wiki.whatwg.org/wiki/Sanitization_rules#svg_Elements
https://wiki.whatwg.org/wiki/Sanitization_rules#svg_Attributes	http://angularjs.org/
ftp://127.0.0.1/.	http://jquerymobile.com/
https://hammerjs.github.io/	https://errors.angularjs.org/1.8.2/
http://msdn.microsoft.com/en-us/library/ie/cc196988	http://www.ecma-international.org/ecma-262/5.1/#sec-15.4.4.18
https://lodash.com/docs/4.17.4#merge	https://developer.mozilla.org/docs/Web/API/Blob
https://developer.mozilla.org/docs/Web/API/MediaStream	https://developer.mozilla.org/docs/Web/API/CanvasGradient
http://jsperf.com/isobject4	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/isFinite
https://www.npmjs.com/package/iserror	http://docs.closure-library.googlecode.com/git/local_closure_goog_string_string.js.source.html#line1021
https://developer.mozilla.org/docs/Web/API/File	https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Map
https://developer.mozilla.org/docs/Web/API/ImageData	https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Set
https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/WeakMap	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/get
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/set	http://en.wikipedia.org/wiki/Partial_application
http://en.wikipedia.org/wiki/Currying#Contrast_with_partial_function_application	https://github.com/angular/angular.js/pull/14221

Page 1 of 5

Raw Manifest

{
  "name": "__MSG_extensionName__",
  "icons": {
    "48": "images/icon48.png",
    "128": "images/icon128.png"
  },
  "author": "AppWork GmbH",
  "version": "3.3.20",
  "commands": {
    "auto-grab-downloads": {
      "description": "__MSG_toggle_auto_grab_links__",
      "suggested_key": {
        "mac": "Command+Shift+Y",
        "default": "Ctrl+Shift+Y"
      }
    },
    "toggle-clipboard-observer": {
      "description": "__MSG_toggle_clipboard_observer__",
      "suggested_key": {
        "mac": "Command+Shift+X",
        "default": "Ctrl+Shift+X"
      }
    }
  },
  "background": {
    "page": "index.html",
    "persistent": true
  },
  "options_ui": {
    "page": "index.html#!/settings"
  },
  "short_name": "MyJDownloader",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extensionDescription__",
  "permissions": [
    "tabs",
    "storage",
    "webRequest",
    "webRequestBlocking",
    "contextMenus",
    "<all_urls>"
  ],
  "homepage_url": "https://my.jdownloader.org",
  "browser_action": {
    "default_icon": "images/icon32.png",
    "default_popup": "popup.html",
    "default_title": "MyJDownloader"
  },
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "contentscripts/rc2Contentscript.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    },
    {
      "js": [
        "contentscripts/rc2LoadingIndicator.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    },
    {
      "js": [
        "contentscripts/onCopyContentscript.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    },
    {
      "js": [
        "contentscripts/toolbarContentscript.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    },
    {
      "js": [
        "contentscripts/selectionContentscript.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    },
    {
      "js": [
        "contentscripts/webinterfaceEnhancer.js"
      ],
      "run_at": "document_end",
      "matches": [
        "http://my.jdownloader.org/*",
        "https://my.jdownloader.org/*",
        "http://my.jdownloader.org/*"
      ],
      "all_frames": true
    }
  ],
  "manifest_version": 2,
  "web_accessible_resources": [
    "toolbar.html",
    "autograbber-indicator.html",
    "res/browser_solver_template.html"
  ]
}

by ✦ Astarte

MyJDownloader Browser Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (340 total):

Raw Manifest

Detections

Manifest Findings