Is XDM Browser Monitor safe?

Medium risk

XDM Browser Monitor collects cookies and request headers for intercepted downloads and sends them to the local XDM app via plaintext HTTP.

When a download is triggered, the extension captures all request and response headers — including Authorization and Cookie headers — and posts them to a local endpoint at http://127.0.0.1:9614. It also reads cookies for every linked URL on a page (not just the target download), meaning cookies from unrelated domains can be collected. All communication uses plaintext HTTP on localhost, with no transport-layer protection.

subhra74v2.2Firefox Add-ons
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Download-all-links collects cookies for every linked URL.

When you use download-all-links, the extension collects every hyperlink on the page, reads cookies for each link's domain, and posts the URL and cookie data to 127.0.0.1:9614/links, including links you never chose to download.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You use the download-all-links feature.

The extension did this

The extension collects every linked URL on the page and reads cookies for each linked URL's domain.

02EvidenceNETWORK CAPTURE
Captured request
POST127.0.0.1:9614/links
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Cookies for linked sites
sessionid=d7f3a1b2-... (illustrative)Cookies can identify your sessions or account state for domains linked from the page.
Linked page URL
https://example.com/download.zip (illustrative)Each URL shows which external pages appeared as hyperlinks on the active page, even if you did not select them individually.

Data recipients

127.0.0.1:9614
Updated 17 September 2026amo-929143