Is Debrid-Link safe?

Medium risk

Debrid-Link renders notification details into every HTTP/HTTPS page where page scripts can read them.

Debrid-Link injects its notification UI into all normal web pages and loads current extension notifications from the background script. Those notifications can include torrent names, file names, source URLs, and generated download links, and the displayed text sits in the page DOM where scripts on that page can read it.

DebridLinkv5.4.1Chrome Web Store
45Risk
Who publishes it

DebridLink - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
DebridLink
Website
debrid-link.com/contact

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

debrid-link.fr
Also called by 2 other listings, including Debrid-Link Plugin
we.debrid-link.fr
Also called by 2 other listings, including Debrid-Link Plugin
debrid-link.com
Also called by 3 other listings, including Debrid-Link Plugin

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Debrid-Link captures Authorization and Cookie headers from every website

Debrid-Link captures the Authorization and Cookie headers of every web request by default before checking if it involves a torrent.

A planted marker header sent from an unrelated site was captured and replayed by the background worker.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You browse to any http or https website while Debrid-Link is installed with its default settings.

No Debrid-Link related site needs to be involved for this to happen.

The extension did this

The background worker records that request's full outbound headers, including Authorization, before it knows what the response will be.

Up to 300 of these captured header sets are kept in memory at once.

A newly aggressive default

A similar feature existed in version 5.1.2, but it only watched completed downloads and never read request headers. Version 5.4.0 added the header capture and turned the feature on by default.

Header data captured from an ordinary page load
  • Authorization header
    Authorization: Bearer 5f3c9a1e... (illustrative)

    Login and API tokens sent in this header are captured for every site, not just Debrid-Link's own.

  • Other request headers
    X-Session-Token: 8f2a1c9e... (illustrative)

    Any other header a page attaches to its request, including app-specific session tokens, is captured the same way.

  • Request URL
    https://mail.example.com/api/messages (illustrative)

    The address of the page's request is stored alongside its headers, tying the captured data to a specific site.

Captured request
GEThttps://httpbin.org/response-headers?Content-Type=application%2Fx-bittorrent&Content-Disposition=attachment%3Bfilename%3Dtest.torrent

This is the extension's own replay of a request it had already captured from an unrelated test page. It reused the Authorization and X-Session-Token values from that earlier request and received a torrent file back, confirming the captured headers are retained and reusable rather than only briefly inspected.

Headers
Authorization
<redacted, marker value confirmed captured and replayed>
X-Session-Token
<redacted, marker value confirmed captured and replayed>
Reproduce it yourself

Fetches a plain URL with a distinctive Authorization header and a torrent content type response, then shows how to confirm in the extension's own service worker console that the header was captured and stored.

Requires
  • A browser with the extension installed at its default settings
  • chrome://extensions Developer mode access to the extension's service worker inspector
debrid-link-header-capture-repro.html · html
<!doctype html><title>Debrid-Link header capture reproducer</title><pre id="out">running...</pre><script>(async () => {  const marker = 'test-marker-' + Math.random().toString(36).slice(2);  const url = 'https://httpbin.org/response-headers'    + '?Content-Type=application%2Fx-bittorrent'    + '&Content-Disposition=attachment%3Bfilename%3Dtest.torrent';  const res = await fetch(url, {    headers: { 'Authorization': 'Bearer ' + marker }  });  document.getElementById('out').textContent =    'Sent Authorization: Bearer ' + marker + '\n' +    'Response status: ' + res.status + '\n\n' +    'Now open chrome://extensions, enable Developer mode, find Debrid-Link,\n' +    'and click its "service worker" link to open the inspector.\n' +    'In the console, run:\n\n' +    '  sessionStates.downloadTorrentValidRequests\n\n' +    'and confirm an entry contains the marker value above in its requestHeaders.';})();</script>
How to run it
  1. 1Host on an unrelated origin.
  2. 2Load it with the extension at default settings.
  3. 3Open chrome://extensions Developer mode, click its service worker link.
  4. 4Run sessionStates.downloadTorrentValidRequests, check for the marker.
Updated 30 September 2026nfdhjpliieckopfcpeglebihglikgojn