Most of the code lives in <tt>toolkit/components/downloads/ApplicationReputation.cpp</tt>.
The list of file extensions that Chrome submits for remote verification lives inside a "File Type Policies" Chrome extension (see `chrome://components`) and uses this protobuf file as the source: https://cs.chromium.org/chromium/src/chrome/browser/resources/safe_browsing/download_file_types.asciipb
== QA ==