What our analysis found

IDM Integration Module, used by 21,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in June 2026.

This is the official IDM Integration Module by Tonec FZE, the makers of Internet Download Manager. All external communication flows exclusively to localhost WebSocket ( — the IDM desktop app) or via nativeMessaging to 'com.tonec.idm'; no data is sent to any remote third-party server. The ML model correctly scored this 0.00 (low risk); the risk engine's 'Critical' flag is purely permission-surface-area-driven, not evidence of malicious behavior. The ROT13 encoding of Web API property names (XMLHttpRequest, fetch, etc.) in lines 218–221 is light obfuscation used to pass property-name strings to for interception — a standard streaming-media capture technique — with no dynamic code execution or encrypted payload loading.