downloads

This permission is for extensions that need to manage, automate, or enhance the file downloading process.

Examples:

• A "batch downloader" that downloads all images or links from a page.
• A download manager that provides more advanced filtering or organization features.
• An extension that saves content to a cloud service by intercepting a download and uploading it instead.

This permission triggers a warning on installation.

{
  "name": "My Downloads Extension",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "downloads"
  ],
  "action": {}
}

Why is it risky?

This permission lets an extension write files to disk and inspect the user's full download history. A malicious or buggy extension can:

• Drop arbitrary files (including binaries, installers, or malware) into the user's Downloads folder without per-file consent.
• Enumerate previously downloaded items via chrome.downloads.search, exposing a sensitive history of what the user has downloaded.
• Erase items from the download history via chrome.downloads.erase.

Files are not automatically opened — that requires the separate, far more dangerous downloads.open permission — but writing files to disk is itself a meaningful capability. Treat any extension that requests downloads for <all_urls>-style automation with care.

This example downloads a specific image file when the user clicks the extension's icon.

// background.js

chrome.action.onClicked.addListener(() => {
  const imageUrl = 'https://picsum.photos/200/300';

  chrome.downloads.download({
    url: imageUrl,
    filename: 'random-image.jpg', // Optional: specify a filename
    saveAs: false // Optional: set to true to prompt user for save location
  }, (downloadId) => {
    if (chrome.runtime.lastError) {
      console.error("Download failed:", chrome.runtime.lastError.message);
    } else {
      console.log("Download started with ID:", downloadId);
    }
  });
});