Is BitComet Download Extension safe?

High risk

BitComet is high risk. Clicking a download link makes the content script read the page's cookies and URL, then send them to BitComet's native host via the background worker. DA observed the config path but not this message; the host was unavailable in testing.…

www.bitcomet.comv1.96.0Chrome Web Store
78Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Download clicks can relay page cookies to BitComet

Clicking a download link makes the content script read the page's cookies and URL, then send them to BitComet's native host via the background worker.

DA observed the config path but not this message; the host was unavailable in testing.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You click a download link on a regular web page.

The link must match the extension's configured file-extension filter.

The extension did this

The extension reads the page cookies and sends them with the link and page URL to the BitComet helper.

The code path is present on every HTTP and HTTPS page where the content script is injected.

Fields assembled for the native Download message
  • Page cookies
    SESSION=7f6b1b0c9a4e; theme=dark (illustrative)

    This can include login or session values that the current page exposes to scripts.

  • Clicked download link
    https://downloads.example.org/releases/client-1.2.3.zip (illustrative)

    This identifies the file or URL you selected for download.

  • Current page URL
    https://portal.example.org/account/files (illustrative)

    This reveals the page where the download click happened.

  • Native action name
    Download

    This tells the local BitComet helper to handle the download request.

The code that does this

Content-script cookie capture and background native-message relay

Readable version

Content script click handler

js/content.js
function onLinkClick(event) {	if (bPluginEnabled)	{		var linkUrl = this.href;        var checkResult = checkDownloadLink(linkUrl, sExtFilterList);        if (checkResult != false)         {    		chrome.runtime.sendMessage({name:"CaptureDownload", link:linkUrl, cookie:document.cookie, referurl:document.location.href});    		return event.preventDefault();    	}	}}

Background message router

background.js
chrome.runtime.onMessage.addListener(		function (message, sender, response)		{			if (message.name == "CaptureDownload")			{				InvokeDownload(message.link, message.cookie, message.referurl);			}			else if (message.name == "showFileDownloadNotification")			{				showFileDownloadNotification(message.item, message.i18nMessage);			}			else if (message.name == "CheckHostConfig")			{			    InvokeGetHostConfig();			}			else if (message.name === 'setContextMenuTitle') {				UpdateContextMenuTitle(message.title);			}			else if (message.name == "setPluginEnable")			{			    SetPluginEnabled(message.value);			}			else if (message.name == "launchProgram")			{			    InvokeLaunchProgram();			}			response(true);		}	);

Native Download message

background.js
function InvokeDownload(link, cookie, referurl) {	chrome.runtime.sendNativeMessage('com.bitcomet.chrome_extension',	  { action:"Download", link:link, cookie:cookie, referurl:referurl },	  function(response) {		if (chrome.runtime.lastError) {			console.log("InvokeDownload Error: " + chrome.runtime.lastError.message);		} else {			console.log("InvokeDownload Received: " + JSON.stringify(response));		}	  });	return;}
The code that does this

Manifest scope for the content script

Readable version
"content_scripts": 	[ 		{			"js": [ "js/content.js" ],			"matches": [ "http://*/*", "https://*/*" ]		} 	]
Destination named by the native messaging call
    • com.bitcomet.chrome_extension

    Local BitComet native messaging host that receives the Download action with link, cookie, and referurl fields.

BitComet helper receives cookies for download URLs

Starting a download via the context menu or notification, the background worker reads all cookies for that URL, sending them with URL/referrer to BitComet's native host.

DA saw the config path, not the handoff: host unavailable for testing.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You start a download through BitComet's browser extension.

The source paths include the link context menu and the download-notification confirmation button.

The extension did this

The extension reads cookies for the selected URL and forwards them to the local BitComet helper.

The cookie string is sent with the download URL and referrer in a native Download message.

Fields assembled by PrepareDownload and InvokeDownload
  • Cookies for the URL's site
    SID=0b3c9a1e5f7d; auth_token=31f4a8c2d0be; locale=en-US (illustrative)

    This can include account, preference, or session cookies associated with the download URL's site.

  • Download URL
    https://files.example.net/private/report-2026.zip (illustrative)

    This identifies the file or page being handed off to BitComet.

  • Referrer URL
    https://files.example.net/account/downloads (illustrative)

    This can reveal the page that initiated the download.

  • Native action name
    Download

    This tells the local BitComet helper to start handling the download.

The code that does this

Cookie collection and native Download handoff

Readable version

Context-menu download trigger

background.js
function onStartupDownload(info, tab) {	if (info.pageUrl == "chrome://downloads/") {		chrome.downloads.search(			{url: info.linkUrl, orderBy: ['-startTime'], limit: 1},			function(data) {				var refererUrl = "";				if (data && data.length > 0) {					var DownloadItem = data[0];					refererUrl = DownloadItem.referrer;				}				PrepareDownload(info.linkUrl, refererUrl);			});	} else {		PrepareDownload(info.linkUrl, info.pageUrl);	}}

Cookie retrieval and concatenation

background.js
function PrepareDownload(link, refererUrl) {	chrome.cookies.getAll({url:link}, function(cookies) {		var cookie = "";		for (i in cookies) {			cookie = cookie.concat(cookies[i].name, "=", cookies[i].value, "; ");		};		InvokeDownload(link, cookie, refererUrl);	});}

Native Download message

background.js
function InvokeDownload(link, cookie, referurl) {	chrome.runtime.sendNativeMessage('com.bitcomet.chrome_extension',	  { action:"Download", link:link, cookie:cookie, referurl:referurl },	  function(response) {		if (chrome.runtime.lastError) {			console.log("InvokeDownload Error: " + chrome.runtime.lastError.message);		} else {			console.log("InvokeDownload Received: " + JSON.stringify(response));		}	  });	return;}

Context menu registration

background.js
function CreateContextMenu(){	chrome.contextMenus.removeAll(function() {		chrome.contextMenus.create({id:contextMenuId, type:"normal", title:"Download with BitComet", contexts:["link"], enabled:true});		chrome.contextMenus.onClicked.addListener((info, tab) => {			if (info.menuItemId == contextMenuId) {				onStartupDownload(info, tab);			}		});	});}
The code that does this

Permissions that allow cookie access for download URLs

Readable version
"permissions": 	[	"contextMenus", 		"cookies",		"nativeMessaging",		"downloads",		"notifications",		"storage",		"alarms"	],	"host_permissions": [		"http://*/*", 		"https://*/*"	]
Destination named by the native messaging call
    • com.bitcomet.chrome_extension

    Local BitComet native messaging host that receives the Download action with link, cookie, and referurl fields.

What it can do

Permissions this extension asks for, as declared in version 1.96.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

  • Start, monitor and manage your downloads

    downloads

  • Show you desktop notifications

    notifications

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

Updated 30 September 2026dhigneefebkcagnpnpbibganpmfgebnk