Is BitComet Download Extension safe?

High risk

BitComet is high risk. Clicking a download link makes the content script read the page's cookies and URL, then send them to BitComet's native host via the background worker. DA observed the config path but not this message; the host was unavailable in testing.…

www.bitcomet.comv1.96.0Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI SANDBOX

Download clicks can relay page cookies to BitComet

Clicking a download link makes the content script read the page's cookies and URL, then send them to BitComet's native host via the background worker.

DA observed the config path but not this message; the host was unavailable in testing.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click a download link on a regular web page.

The link must match the extension's configured file-extension filter.

The extension did this

The extension reads the page cookies and sends them with the link and page URL to the BitComet helper.

The code path is present on every HTTP and HTTPS page where the content script is injected.

02EvidenceFIELD TABLE
Fields assembled for the native Download message
FieldValueWhy it matters
Page cookies
SESSION=7f6b1b0c9a4e; theme=dark (illustrative)This can include login or session values that the current page exposes to scripts.
Clicked download link
https://downloads.example.org/releases/client-1.2.3.zip (illustrative)This identifies the file or URL you selected for download.
Current page URL
https://portal.example.org/account/files (illustrative)This reveals the page where the download click happened.
Native action name
DownloadThis tells the local BitComet helper to handle the download request.
03EvidenceCODE COMPARE
The code that does this

Content-script cookie capture and background native-message relay

What it actually does
Content script click handlerjs/content.js
function onLinkClick(event) 
{
	if (bPluginEnabled)
	{
		var linkUrl = this.href;
        var checkResult = checkDownloadLink(linkUrl, sExtFilterList);
        if (checkResult != false) 
        {
    		chrome.runtime.sendMessage({name:"CaptureDownload", link:linkUrl, cookie:document.cookie, referurl:document.location.href});
    		return event.preventDefault();
    	}
	}
}
Background message routerbackground.js
chrome.runtime.onMessage.addListener(
		function (message, sender, response)
		{
			if (message.name == "CaptureDownload")
			{
				InvokeDownload(message.link, message.cookie, message.referurl);
			}
			else if (message.name == "showFileDownloadNotification")
			{
				showFileDownloadNotification(message.item, message.i18nMessage);
			}
			else if (message.name == "CheckHostConfig")
			{
			    InvokeGetHostConfig();
			}
			else if (message.name === 'setContextMenuTitle') {
				UpdateContextMenuTitle(message.title);
			}
			else if (message.name == "setPluginEnable")
			{
			    SetPluginEnabled(message.value);
			}
			else if (message.name == "launchProgram")
			{
			    InvokeLaunchProgram();
			}
			response(true);
		}
	);
Native Download messagebackground.js
function InvokeDownload(link, cookie, referurl) 
{
	chrome.runtime.sendNativeMessage('com.bitcomet.chrome_extension',
	  { action:"Download", link:link, cookie:cookie, referurl:referurl },
	  function(response) {
		if (chrome.runtime.lastError) {
			console.log("InvokeDownload Error: " + chrome.runtime.lastError.message);
		} else {
			console.log("InvokeDownload Received: " + JSON.stringify(response));
		}
	  });
	return;
}
04EvidenceCODE COMPARE
The code that does this

Manifest scope for the content script

What it actually does
"content_scripts": 
	[ 
		{
			"js": [ "js/content.js" ],
			"matches": [ "http://*/*", "https://*/*" ]
		} 
	]
05EvidenceTHIRD PARTY LIST
Destination named by the native messaging call
  • com.bitcomet.chrome_extension

    Local BitComet native messaging host that receives the Download action with link, cookie, and referurl fields.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI SANDBOX

BitComet helper receives cookies for download URLs

Starting a download via the context menu or notification, the background worker reads all cookies for that URL, sending them with URL/referrer to BitComet's native host.

DA saw the config path, not the handoff: host unavailable for testing.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You start a download through BitComet's browser extension.

The source paths include the link context menu and the download-notification confirmation button.

The extension did this

The extension reads cookies for the selected URL and forwards them to the local BitComet helper.

The cookie string is sent with the download URL and referrer in a native Download message.

02EvidenceFIELD TABLE
Fields assembled by PrepareDownload and InvokeDownload
FieldValueWhy it matters
Cookies for the URL's site
SID=0b3c9a1e5f7d; auth_token=31f4a8c2d0be; locale=en-US (illustrative)This can include account, preference, or session cookies associated with the download URL's site.
Download URL
https://files.example.net/private/report-2026.zip (illustrative)This identifies the file or page being handed off to BitComet.
Referrer URL
https://files.example.net/account/downloads (illustrative)This can reveal the page that initiated the download.
Native action name
DownloadThis tells the local BitComet helper to start handling the download.
03EvidenceCODE COMPARE
The code that does this

Cookie collection and native Download handoff

What it actually does
Context-menu download triggerbackground.js
function onStartupDownload(info, tab) 
{
	if (info.pageUrl == "chrome://downloads/") {
		chrome.downloads.search(
			{url: info.linkUrl, orderBy: ['-startTime'], limit: 1},
			function(data) {
				var refererUrl = "";
				if (data && data.length > 0) {
					var DownloadItem = data[0];
					refererUrl = DownloadItem.referrer;
				}
				PrepareDownload(info.linkUrl, refererUrl);
			});
	} else {
		PrepareDownload(info.linkUrl, info.pageUrl);
	}
}
Cookie retrieval and concatenationbackground.js
function PrepareDownload(link, refererUrl) 
{
	chrome.cookies.getAll({url:link}, function(cookies) {
		var cookie = "";
		for (i in cookies) {
			cookie = cookie.concat(cookies[i].name, "=", cookies[i].value, "; ");
		};
		InvokeDownload(link, cookie, refererUrl);
	});
}
Native Download messagebackground.js
function InvokeDownload(link, cookie, referurl) 
{
	chrome.runtime.sendNativeMessage('com.bitcomet.chrome_extension',
	  { action:"Download", link:link, cookie:cookie, referurl:referurl },
	  function(response) {
		if (chrome.runtime.lastError) {
			console.log("InvokeDownload Error: " + chrome.runtime.lastError.message);
		} else {
			console.log("InvokeDownload Received: " + JSON.stringify(response));
		}
	  });
	return;
}
Context menu registrationbackground.js
function CreateContextMenu()
{
	chrome.contextMenus.removeAll(function() {
		chrome.contextMenus.create({id:contextMenuId, type:"normal", title:"Download with BitComet", contexts:["link"], enabled:true});
		chrome.contextMenus.onClicked.addListener((info, tab) => {
			if (info.menuItemId == contextMenuId) {
				onStartupDownload(info, tab);
			}
		});
	});
}
04EvidenceCODE COMPARE
The code that does this

Permissions that allow cookie access for download URLs

What it actually does
"permissions": 
	[	"contextMenus", 
		"cookies",
		"nativeMessaging",
		"downloads",
		"notifications",
		"storage",
		"alarms"
	],

	"host_permissions": [
		"http://*/*", 
		"https://*/*"
	]
05EvidenceTHIRD PARTY LIST
Destination named by the native messaging call
  • com.bitcomet.chrome_extension

    Local BitComet native messaging host that receives the Download action with link, cookie, and referurl fields.

What it can do

Permissions this extension asks for, as declared in version 1.96.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

  • Start, monitor and manage your downloads

    downloads

  • Show you desktop notifications

    notifications

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

Updated 30 September 2026dhigneefebkcagnpnpbibganpmfgebnk