Protects organizations from HTML Smuggling and other download-based attack vectors by allowing IT administrators to define policies that block, audit, or notify on downloads matching specific criteria (file extension, origin, domain, SHA256 hash, URL scheme)

1) IT admin deploys the extension via Chrome enterprise policy with a JSON configuration defining blocking rules (banned extensions, allowed origins, domain patterns, etc.). 2) The extension injects a content script into all pages to intercept JavaScript-based downloads (HTML Smuggling). 3) When a download is initiated, the background service worker evaluates it against configured rules. 4) Based on the rule match, the extension either blocks the download (cancels/deletes the file), audits it (logs for review), or notifies the user. 5) SHA256 hashes and file inspection data can be used for more granular policy decisions.

Target users: Enterprise IT administrators / Security teams deploying managed Chrome browsers / Organizations needing download policy enforcement

No UI code for end-user configuration visible — all config is via managed storage policy, so full user experience requires enterprise deployment
The extension is open-source on GitHub but the full documentation is external and not analyzed

Monetization

No paid features detected

No paid features, subscriptions, licensing, or payment gates exist in the extension. All 'pro' keyword hits are false positives from words like 'process', 'promise', 'properties', 'protocol', 'processing' — none relate to paid tiers. The extension is open-source (GitHub repo linked), uses no payment platforms, and contains no billing/upgrade/licensing logic.

Confidence: 95
Payment platform: --
Source: AI / High
Login required: No
Reason: No user login or account creation is required to use the extension. All 'session' keyword hits reference chrome.storage.session (Chrome's temporary extension storage API), not user authentication sessions. The schema.json mentions 'Username' and 'Hostname' fields, but these are enterprise-managed policy values pushed via chrome.storage.managed by IT administrators — not user login credentials. There are no OAuth flows, login screens, API keys, or account registration flows in the source code.

Permission risk

High-risk permissions

This estimate uses declared permissions and host permissions to assess access scope and sensitivity.

敏感权限：nativeMessaging
扩展能力较强：downloads、tabs、storage、scripting
主机权限覆盖范围较宽
同时具备浏览数据与站点访问能力

Publisher

SecurityJosh

Independent publisher

Email: [email protected]
Phone: --
Address: --

Public contact fields are shown above. Developer portfolio pages are available on paid accounts.

View developer portfolio

Permissions

Host access