Chrome Web StoreCaution required
Suspicious in code review (v7.1.1)
Our reviewer found behaviour consistent with malware in version 7.1.1, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
Fans Downloader, used by 10,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by other. Its permissions mean it can inject scripts into pages.
Key findings
- High
Other
The bundled manifest for v7.1.1 differs materially from the published CWS manifest for the same version: the published manifest declares a `webRequest` permission that is entirely absent from the bundled copy, the web-accessible resource file hashes differ ( vs), and the bundled manifest adds a second web_accessible_resources block granting all websites (`[domain withheld], `[domain withheld]) access to the Fansly content scripts — a block not present in the published manifest. A permission mismatch within the same declared version suggests the distributed ZIP and the Google-reviewed listing describe different code.
- Medium
Tracking
The service worker contacts the third-party domain [domain withheld] on every license check, sending the extension's own runtime ID via the custom 'extensionid' header and including any existing cookies for that domain (`credentials: include`). The response can return a user's registered email address and an auth token. This constitutes undisclosed contact with a third-party service; the CWS data-collection disclosure for this extension is 'none declared', and [domain withheld] is unrelated to the extension's stated download purpose.
Analyst notes
The extension's core download functionality for is legitimate and the API-response interception (via hooks in MAIN world) only captures responses from on-domain endpoints and passes them locally via postMessage — no exfiltration to external servers. However, two concrete issues exist: (1) the service worker contacts `[domain withheld] with the extension's runtime ID in a custom header and `credentials: include`, and the response can return a user email and token — this is a third-party licensing service not disclosed in the CWS data-collection declaration; (2) the bundled manifest for v7.1.1 is materially different from the published manifest — the published version declares a `webRequest` permission absent from the bundled manifest, lists different web-accessible resource file hashes, and omits the bundled manifest's second `web_accessible_resources` block that exposes fansly scripts to all websites (`[domain withheld]). The ML score (0.02) and publisher reputation (0 malicious out of 3 other extensions) argue against malice, but the undisclosed third-party identity check and manifest discrepancy are genuine concerns that warrant a suspicious label.
Fans Downloader Chrome extension security report
ID: fgenpmnicempmgjndjjfnaidecihefnm
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- WebMedia Tech
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Screenshots & videos
Install growth
About this extension
Download images and videos from onlyfans.com and fansly.com
Read the publisher’s full description
This tool allows you to quickly backup videos and images from the OnlyFans creators you follow, ensuring you have access to your favorite content whenever you want. Please note that you must follow or subscribe to the OnlyFans creator first.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from WebMedia Tech
- Fansly Downloader3,000 users
Popular in lifestyle/social
- vidIQ Vision for YouTube4,000,000 users
- Skype3,000,000 users
- Skype Calling2,000,000 users
- Google Meet Tweak (Emojis, Text, Cam Effects)900,000 users
- VidyoWebConnector600,000 users