Is Trim: IMDB Rating on Netflix, Prime & Disney+ safe?

Medium risk

Trim IMDB Rating sends your streaming page URLs, browsing metadata, and Netflix content details to its own servers and Google Analytics.

On Netflix, the extension reads movie and show metadata from the page DOM — including titles, cast, genres, and your geographic locale — and transmits this data along with the current page URL to goodmovies.io with each ratings request. Page views across Netflix, Prime Video, Disney+, HBO, Hulu, Apple TV, Peacock, and Paramount+ are also reported to Google Analytics with a persistent client ID that links activity across sessions. When a user authenticates via gettrim.cc, the extension receives a JWT token, forwards it to goodmovies.io/auth, and retains the returned email address and customer ID in memory.

goodmoviesv8.03Chrome Web Store
49Risk
Who publishes it

goodmovies - 3 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
goodmovies

Same store account

3 other listings published from this account, 67k+ users between them, none of them carrying a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Streaming page views sent to Google Analytics with persistent user ID

Each time you navigate within Netflix, Prime Video, Disney+, HBO Max, Hulu, Apple TV+, Peacock, or Paramount+, Trim sends the page URL, title, and referrer to Google Analytics under a persistent ID, letting the publisher track your viewing.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any page on a supported streaming service.

Supported services: Netflix, Amazon Prime Video, Disney+, HBO Max, Hulu, Apple TV+, Peacock, Paramount+.

The extension did this

The extension posts the page URL, title, and referrer to Google Analytics together with a persistent device ID.

The ID is generated once and stored in chrome.storage.local; it does not reset between browser sessions.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-6R0YJ1856Q&api_secret=<redacted>

HTTP 204 No Content, event accepted by Google Analytics Measurement Protocol

Headers
Content-Type
application/json
Body
{  "client_id": "5f7b3a1d-3592-4ae2-81fb-f594137bf64a",  "events": [    {      "name": "page_view",      "params": {        "page_title": "Watch Demon Slayer: Kimetsu no Yaiba | Netflix",        "page_location": "https://www.netflix.com/gb/title/81091393",        "page_referrer": "https://www.netflix.com/browse",        "session_id": "1717660234512",        "engagement_time_msec": 100,        "request_id": "abc123",        "trim_version": "8.03"      }    }  ]}
Fields sent to Google Analytics on every streaming page navigation
  • Device ID
    5f7b3a1d-3592-4ae2-81fb-f594137bf64a

    A permanent random ID set the first time the extension runs, letting Analytics link every streaming page you visit to your device.

  • Full page URL
    https://www.netflix.com/gb/title/81091393

    The exact address of the streaming page, which can include the title ID and region code (e.g. /gb/title/81091393 on Netflix).

  • Page title
    Watch Demon Slayer: Kimetsu no Yaiba | Netflix

    The browser tab title, which typically contains the name of the film or show you are viewing.

  • Referring URL
    https://www.netflix.com/browse

    The page you came from, for example, a Netflix browse or genre page, which reveals navigation patterns within the platform.

  • Session ID
    1717660234512

    A timestamp-derived ID that groups your activity within a 30-minute window, allowing per-session viewing sequences to be reconstructed.

The code that does this

Page-view assembly in the Netflix content script and background dispatch

Readable version

What the page-view function does in plain terms

// On each navigation, collect page metadata and forward to GAfunction sendPageView(extraParams = {}) {  const params = {    page_title: document.title,   // e.g. "Watch Demon Slayer | Netflix"    page_location: document.location.href,  // full URL    page_referrer: document.referrer,       // previous page    ...extraParams  };  chrome.runtime.sendMessage({ action: 'analyze', event: 'page_view', params });}// background.js: clientId persists across browser sessionsasync function getOrCreateClientId() {  let { clientId } = await chrome.storage.local.get('clientId');  if (!clientId) {    clientId = crypto.randomUUID();    await chrome.storage.local.set({ clientId });  }  return clientId;  // same UUID on every future call}
Destination receiving streaming browsing data
    • www.google-analytics.com

    Google Analytics endpoint (property G-6R0YJ1856Q). Receives page URL, title, referrer, and persistent device ID on every navigation. Accessible to the publisher via GA4.

Netflix page URL and geo locale sent to goodmovies.io with each ratings request

Each time Trim fetches IMDB or Rotten Tomatoes ratings on Netflix, it sends the page's URL plus your locale, country, and movie IDs to goodmovies.io, the publisher's server, which logs which titles you viewed, when, and where.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You load or scroll a Netflix browse page containing content tiles.

The extension's MutationObserver fires each time new DOM elements appear on Netflix.

The extension did this

The extension sends the full Netflix page URL and your geo locale to goodmovies.io alongside the movie IDs it is looking up ratings for.

The geo object includes locale (language and country) and requestCountry (country ID and name) read directly from Netflix's internal React context.

Captured request
POSThttps://goodmovies.io/rating

HTTP 200, goodmovies.io returns rating data for the requested movie IDs

Headers
Accept
application/json
Content-Type
application/json
Body
{  "version": "3",  "queries": [    {      "movieId": "81091393"    }  ],  "geo": {    "locale": {      "id": "en-GB",      "language": "en",      "countryCode": "GB"    },    "requestCountry": {      "id": "GB",      "countryName": "United Kingdom"    }  },  "location": "https://www.netflix.com/gb/title/81091393"}
Fields in the goodmovies.io/rating request beyond the movie IDs
  • Current page URL
    https://www.netflix.com/gb/title/81091393

    The exact Netflix URL viewed, encoding title ID and region (e.g. /gb/). With server timestamps this rebuilds your Netflix browse history.

  • Locale
    en-GB

    Your Netflix locale, language, and country, read from Netflix's React data. Reveals which regional library you're accessing.

  • Country
    United Kingdom (GB)

    Full country name and country ID from Netflix's geo model. Tells goodmovies.io which Netflix region you are subscribed to.

The code that does this

Rating request assembly in netflix/content.js, lines 147-168

Readable version

Plain-English reading of T()

// Called on each MutationObserver trigger when new content tiles appearfunction sendRatingsRequest(movieIdList, module, refetches, requestType) {  const geo = module.getGeo();  // {locale: {id, language, countryCode}, requestCountry: {id, countryName}}  const payload = {    version: '3',    queries: movieIdList,          // array of { movieId: '81091393' }    geo: geo,                      // user's locale and country from Netflix internals    location: window.location.href // full current Netflix URL  };  const ratingEndpoint = module.ratingUrl(window.location.hostname);  // ratingUrl() always returns 'https://goodmovies.io/rating'  chrome.runtime.sendMessage({    action: 'getRatings',    url: ratingEndpoint,    data: payload,   // includes full URL and geo — not just movie IDs    refetches,    type: requestType  });}
Destination receiving Netflix browsing context
    • goodmovies.io

    Rating API run by Trim's publisher. Receives movie/show ID batches with your current page URL, locale, and country per page load. Retention policy isn't disclosed in the listing.

What it can do

Permissions this extension asks for, as declared in version 8.03. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on goodmovies.io

    https://goodmovies.io/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed IMDB Rating on Netflix, Prime & Disney+ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    IMDB Rating on Netflix, Prime & Disney+ sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • goodmovies.io

    IMDB Rating on Netflix, Prime & Disney+ sends data to goodmovies.io. No other extension we have analysed sends data here.

Updated 30 September 2026lpgajkhkagnpdjklmpgjeplmgffnhhjj