Is Product Image Downloader (Fatkun Alternative) safe?

Medium risk

Product Image Downloader sends page URLs, user-agent details, and generated IDs to a hardcoded Slack webhook.

When you open the downloader from a page, the extension sends the source page URL, browser user agent, a per-open UUID, a persistent user UUID, and whether media was found to a Slack webhook. It also reports open and download events to Google Analytics with a persistent client ID, site domain, extension version, language, timezone, and country metadata.

percenty_groupv1.0.21Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Image downloader sends page URL and identifiers to Slack webhook.

When you open Product Image Downloader, it sends the current page URL, your browser user agent, a per-open UUID, a stored user UUID, and whether media was present to a Slack webhook.

This happens via the toolbar or context-menu flow.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open the image downloader from the toolbar or context menu.

The extension did this

The extension posts the source page URL, browser user agent, per-open UUID, persistent user UUID, and media-present flag to a Slack webhook.

Captured request
POSThttps://hooks.slack.com/services/T01H86DAJAJ/B07SJ515Z7G/<redacted>
Fields in the request
  • Source page URL
    https://example.com/product/image.jpg (illustrative)

    Shows the page where you opened the downloader, which can reveal browsing context.

  • Browser user agent
    Mozilla/5.0 Chrome/126.0 (illustrative)

    Describes the browser and device environment attached to the open action.

  • Stored user UUID
    d7f3a1b2-4c5d-4e6f-9a10-112233445566 (illustrative)

    Links repeated downloader openings to the same extension storage identifier.

What it can do

Permissions this extension asks for, as declared in version 1.0.20. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.0.21, which we have not unpacked yet.

  • Read and change your data on every site you visit

    *://*/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Add items to the right-click menu

    contextMenus

  • Start, monitor and manage your downloads

    downloads

Where it sends data

Destinations our analysis observed Product Image Downloader (Fatkun Alternative) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Product Image Downloader (Fatkun Alternative) sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • hooks.slack.com

    Product Image Downloader (Fatkun Alternative) sends data to hooks.slack.com. 5 other extensions we have analysed send data here.

  • api.country.is

    Product Image Downloader (Fatkun Alternative) sends data to api.country.is. 3 other extensions we have analysed send data here.

Updated 30 September 2026jhmpcopkebhhagjfmobglpohomllacfd