Is Udemy Course Downloader safe?
Udemy Course Downloader opens an affiliate tracking tab on install and when downloads start.
The extension opens a dhwnh.com affiliate URL when it is installed. When a user clicks the injected Download button on a Udemy course page, it can also open the same affiliate tracking URL in a background tab, limited by a once-per-day localStorage check.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Undisclosed Affiliate Tab Opens on Install and on Every Download Click
Installing this extension opens a tab to dhwnh.com, forwarding to udemy.com with Impact Radius parameters (irpid=313262) crediting the developer.
It reopens once per 24h per Download click, contradicting the listing's tracking claims.
- Severity
- Low unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You install Udemy Course Downloader from the Chrome Web Store.
The background service worker immediately opens a new tab to a third-party affiliate redirector, dhwnh.com.
No prompt or on-screen notice accompanies this; the tab opens automatically as part of the install event.
302 redirect chain: dhwnh.com → trk.udemy.com → ojrq.net → trk.udemy.com → 200 landing on https://www.udemy.com/?im_ref=...&sharedid=439426&irpid=313262&utm_medium=affiliate&utm_source=impact, a live, working affiliate redirect that attributes the install to the developer's Impact Radius affiliate account.
You click the extension's injected Download button on a Udemy course page.
The button is added to https://www.udemy.com/course/* pages by the content script.
The extension opens the same dhwnh.com affiliate tab again, in the background, before the video or text download begins.
The tab opens inactive so it doesn't take focus, and only fires if at least 24 hours have passed since the last time it opened.
Every 1 day
Repeats at most once every 24 hours per download click, gated by a localStorage timestamp rather than a fixed timer.
- dhwnh.com
Affiliate link-tracking domain the extension opens directly on install and on download clicks; the first hop in the redirect chain.
- trk.udemy.com
Udemy's own affiliate-tracking subdomain; relays the click and attaches commission-attribution parameters before continuing the chain.
- ojrq.net
Intermediate hop in the redirect chain between dhwnh.com and the final udemy.com landing page.
The Chrome Web Store listing includes a "Privacy & Security" section stating: "No data collection... No advertisements... No third-party tracking..." The extension nonetheless opens a tab to a third-party affiliate redirector on every install and, subject to a 24-hour cooldown, every time the Download button is clicked.
What it can do
Permissions this extension asks for, as declared in version 3.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on www.udemy.com
https://www.udemy.com/course/*
Read and change your data on udemycdn.com
https://*.udemycdn.com/*
Start, monitor and manage your downloads
downloads
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Where it sends data
Destinations our analysis observed Udemy Course Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- dhwnh.com
Udemy Course Downloader sends data to dhwnh.com. One other extension we have analysed sends data here.