Is GIPHY for Chrome safe?
GIPHY is medium risk. Each GIPHY popup open beacons usage.trackjs.com with a hardcoded token. On a JS error, capture.trackjs.com gets your user agent, popup URL, a click/text-input log, console history, and nav events. Not disclosed in the store listing.
Who publishes itGiphy, Inc. - 1 other listing from the same operator, none carrying a finding
Giphy, Inc. - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 100k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
TrackJS error monitoring transmits popup diagnostics to third-party servers
Each GIPHY popup open beacons usage.trackjs.com with a hardcoded token.
On a JS error, capture.trackjs.com gets your user agent, popup URL, a click/text-input log, console history, and nav events.
Not disclosed in the store listing.
Captured request
Third-party destinations
- usage.trackjs.com
Session beacon, fires on every popup load; receives token, correlationId, session UUID
- capture.trackjs.com
Error reporting, receives diagnostic JSON payload on JS exceptions; includes user agent, console log, interaction log
What it can do
Permissions this extension asks for, as declared in version 3.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Start, monitor and manage your downloads
downloads