Extension Auditor
Extension Auditor
Sign Up
BitComet Download Extension

BitComet Download Extension

ID: dhigneefebkcagnpnpbibganpmfgebnk

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
1.96.0
Size
0.04 MB
Rating
3.6/5
Reviews
45
Users
70,000
Type
Extension
Updated
Nov 6, 2022
Category
Workflow & planning
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Trusted
Author
https://www.bitcomet.com/View Profile
Privacy
Privacy Policy
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Total Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Total Users
70,000
Screenshot 1
Screenshot 2

helps to download files with BitComet

BitComet Download Extension for Chrome add following conveniences for you: 1. Show "Download using BitComet" command in the context menu of links in web page and downloads tab of Chrome. 2. Download file of specified types using BitComet when click links in web pages. The filter list of file types can be configured in BitComet option window. 3. Launch BitComet directly from Chrome toolbar. Note: This extension works only with BitComet v1.38 or later. Official website: http://www.bitcomet.com

Item
Type
Severity
Description
http://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
https://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
nativeMessaging
Permission
High
This permission enables communication with applications installed on your computer. Rated High because it can exchange data with native programs, potentially exposing system-level information and local files.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Reads all cookies scoped to the download URL's domain (including HttpOnly/session cookies via chrome.cookies API) and hands them off to a native messaging host together with the referrer. This is a legitimate pattern for download managers that need to replay authenticated sessions, but it bypasses HttpOnly protection and the cookies leave the browser sandbox into a native binary — worth noting as a sensitive-data flow.

background.js (Line 123)
// retrieve cookies for downloadfunction PrepareDownload(link, refererUrl) {  chrome.cookies.getAll({    url: link  }, function(cookies) {    var cookie = "";    for (i in cookies) {      cookie = cookie.concat(cookies[i].name, "=", cookies[i].value, "; ");    };    InvokeDownload(link, cookie, refererUrl);  });}// Invoke downloadfunction InvokeDownload(link, cookie, referurl) {  chrome.runtime.sendNativeMessage('com.bitcomet.chrome_extension', {        action: "Download",        link: link,        cookie: cookie,        referurl: referurl      },

Content script injected into every http/https page reads document.cookie on link clicks matching a server-provided extension filter list and forwards it to the background page (which then pipes it to the BitComet native host). The filter list `sExtFilterList` is fetched from the native host via InvokeGetHostConfig and is not validated, so compromise/reconfiguration of the native host could widen what link patterns trigger cookie capture.

js/content.js (Line 66)
// link click eventfunction onLinkClick(event) {  if (bPluginEnabled) {    var linkUrl = this.href;    var checkResult = checkDownloadLink(linkUrl, sExtFilterList);    if (checkResult != false) {      chrome.runtime.sendMessage({        name: "CaptureDownload",        link: linkUrl,        cookie: document.cookie,        referurl: document.location.href      });      return event.preventDefault();    }  }}

The extension unconditionally trusts `response.ext_list` from the native messaging host and persists it to storage, where content.js then uses it to decide which link clicks cause document.cookie exfiltration to the native host. No validation/type check on the response means a malicious/compromised native host could push an overly broad filter (e.g., `.html;.php`) and turn this into a universal cookie-collection channel across all http/https sites.

background.js (Line 154)
// Invoke get configfunction InvokeGetHostConfig() {  chrome.runtime.sendNativeMessage('com.bitcomet.chrome_extension', {      action: "GetConfig"    },    async function(response) {      if (chrome.runtime.lastError) {        console.log("InvokeGetHostConfig Error: " + chrome.runtime.lastError.message);      } else {        console.log("Received Config: " + JSON.stringify(response));      }      // load local settings      let settingValues = await chrome.storage.local.get(["sExtFilterList"]);      // save sExtFilterList      if (typeof settingValues == 'undefined' || settingValues.sExtFilterList != response.ext_list) {        chrome.storage.local.set({          sExtFilterList: response.ext_list        });      }    });}

By severity

Critical0
High0
Medium3
Low0

Versions scanned

Showing 1 of 7 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.96.03

Files with findings

2 distinct paths — top paths by unique finding count:

  • background.js2
  • js/content.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Privilege Escalation
medium
background.js (line 154)The extension unconditionally trusts `response.ext_list` from the native messaging host and persists it to storage, where content.js then uses it to decide which link clicks cause document.cookie exfiltration to the n…
1.96.0
2Unauthorized Data Collection
medium
background.js (line 123)Reads all cookies scoped to the download URL's domain (including HttpOnly/session cookies via chrome.cookies API) and hands them off to a native messaging host together with the referrer. This is a legitimate pattern …
1.96.0
3Unauthorized Data Collection
medium
js/content.js (line 66)Content script injected into every http/https page reads document.cookie on link clicks matching a server-provided extension filter list and forwards it to the background page (which then pipes it to the BitComet nati…
1.96.0
URLs
7
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
www.w3.org/1999/02/22-rdf-syntax-nshttp://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
ns.adobe.com/xap/1.0/mm/http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com/xap/1.0/sType/ResourceRefhttp://ns.adobe.com/xap/1.0/sType/ResourceRef#
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
*/*http://*/*
*/*https://*/*

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Showing 1 to 7 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In