What our analysis found

Image Downloader, used by 2,000,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 medium), led by other. Its permissions mean it can inject scripts into pages.

Key findings

• medium· other —The bundled declares 'sidePanel' and 'storage' permissions, but the live Chrome Web Store listing (as provided in the published manifest summary) only shows 'activeTab', 'scripting', and 'downloads'. This mismatch means the CWS page does not fully disclose the actual permissions used, which could mislead users. No malicious activity was found, but the omission is a transparency issue.

The extension uses legitimately for image extraction; no unauthorized network requests or data exfiltration detected. All external links are user-initiated referrals and clearly identified. The publisher is a trusted, featured developer with a strong privacy policy. The ML model score was 0.00 (low) and the third-party risk score is low. The risk-engine overestimates by flagging the 'scripting' permission as critical, but it is used only for its stated purpose. The only minor concern is a mismatch between the bundled manifest and the published CWS permissions list ( omitted), which appears to be a disclosure oversight rather than malicious intent.