Is Get Facebook Cookies & Access Token safe?
We analyzed Get Facebook Cookies & Access Token version 3.1.0's actual code and gave it a 62/100 trust score. This is a purpose-aligned but highly…
Bottom line
This is a purpose-aligned but highly sensitive Facebook credential-retrieval extension with a moderate security weakness and limited evidence of misuse.
What it can access
It can read Facebook cookies and sign-in credentials, observe Facebook traffic, store results, and copy them to the clipboard; this fits its stated purpose but is highly sensitive. [Q1][Q3][Q5][Q14]
Security weaknesses
Facebook page messages are accepted without checking their sender, origin, or freshness, so page content could spoof or corrupt the retrieved result. [Q21]
Signs of misuse
It automatically watches Facebook traffic and reads cookies when opened, but no upload to an unrelated party or remote code execution was found. [Q6][Q7][Q8][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has Facebook host access plus cookies, webRequest, tabs, and storage permissions.
Declares Facebook host access, cookies, webRequest, tabs, storage, and a Facebook content script. — manifest.json:12-37
Which websites can it run on, and can it read or change what appears on those pages?
It reads Facebook page scripts, globals, metadata, hidden inputs, and data attributes to locate a DTSG request token.
Reads DTSGInitialData, window token properties, script text, meta tags, hidden fb_dtsg inputs, and data-dtsg attributes. — libs/content.js:4-143
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It collects Facebook access and request tokens, profile data, and advertising-account metadata; it does not read ordinary messages or form contents.
Extracts access_token from Facebook requests and fetches the associated Facebook profile. — libs/background.js:90-193
Requests account IDs, statuses, currency, business, name, timezone, and country fields from Facebook. — libs/background.js:223-245
Extracts the Facebook DTSG request token. — libs/content.js:4-143
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores the Facebook access token, DTSG token, profile, ad-account list, Graph services base, and preferences in chrome.storage.local.
Defines local storage helpers and persists the captured access token, Graph base URL, and API version. — libs/background.js:40-63,81-87,109-116
Stores Facebook profile data, ad accounts, timestamps, and the DTSG token. — libs/background.js:152-193,223-245,363-370
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It copies Facebook cookies, access tokens, and DTSG tokens to the clipboard when the user clicks the corresponding Copy button.
Copies the displayed Facebook cookie string from a labeled button. — libs/popup.js:112-135
Copies the access token or DTSG token after explicit clicks. — libs/popup.js:219-242,278-307
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the captured access token only to Facebook's own Graph services; no cookie or token upload to an unrelated service was found.
Derives the API origin and version from the same Facebook request that contains the token. — libs/background.js:95-116
Uses that Facebook base URL for /me and /me/adaccounts requests. — libs/background.js:152-245
Returns cookies and DTSG data internally through runtime messages rather than remote requests. — libs/background.js:305-385
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Remote responses are Facebook profile and advertising-account records; behavior remains packaged. — libs/background.js:90-245
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It continuously watches Facebook request URLs for an access token and automatically reads Facebook cookies whenever the popup opens.
Registers the Facebook webRequest listener during service-worker initialization. — libs/background.js:271-280
Requests all Facebook cookies on popup load. — libs/popup.js:345-348
Automatically fetches profile and ad-account information unless the user disables auto mode. — libs/background.js:118-123
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings, proxy, search, management, or privacy permissions. — manifest.json:22-27
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains readable comments, identifiers, fixed Facebook paths, and explicit storage keys. — libs/background.js:1-387
Documents each DTSG extraction method in readable source. — libs/content.js:1-157
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Injects a fixed packaged script into Facebook's page context; no remote or page-supplied text is concatenated into it. — libs/content.js:8-43
Extension pages allow only packaged scripts. — manifest.json:41-43
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Parses access_token only from requests matching Facebook hosts. — libs/background.js:90-116,271-280
Limits host and content-script access to Facebook. — manifest.json:12-14,28-37
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Network requests are limited to Facebook API calls and user navigation to Facebook Ads Manager. — libs/background.js:1-387
Does it send cookies, session details, authentication data, or page contents elsewhere?
It deliberately reads all Facebook cookies plus Facebook access and DTSG tokens, but no transmission to an unintended party was demonstrated.
The name and description explicitly advertise retrieving Facebook cookies and an access token. — _locales/en/messages.json:2-7
Captures access_token from Facebook requests, reads Facebook cookies, and obtains DTSG from a Facebook tab. — libs/background.js:90-124,305-385
Uses the access token only with the originating Facebook Graph API. — libs/background.js:152-245
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Searches specifically for DTSG token patterns, metadata, hidden fb_dtsg input, and data-dtsg attributes. — libs/content.js:63-143
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable interface. — manifest.json:1-55
Handles a fixed set of internal runtime actions. — libs/background.js:282-303,351-385
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates, appends, executes, and removes a fixed inline script for DTSG access. — libs/content.js:4-43
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It observes Facebook requests and makes authenticated Facebook Graph services requests for profile and advertising-account data.
Parses Facebook request URLs and fetches Facebook /me and /me/adaccounts. — libs/background.js:90-245,271-280
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:22-27
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses Facebook JSON as profile and advertising-account records. — libs/background.js:152-245
The page-context script is fixed in the package. — libs/content.js:8-43
Can ordinary websites access privileged extension features through messaging or exposed files?
DTSG extraction uses a Facebook-page window message without checking event.source, origin, or a per-request nonce; this can expose or corrupt the result within the Facebook page context.
Posts DTSG_RESULT with target '*' and accepts the first matching message based only on event.data.type. — libs/content.js:35-59
Returns that page-message value to the requesting extension runtime message. — libs/content.js:146-156
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Names the product Get Facebook Cookies & Access Token. — _locales/en/messages.json:2-7
Labels cookies, access token, DTSG token, Copy, Get DTSG, and automatic-fetch controls. — popup/popup.html:20-116
Starts access-token request monitoring automatically. — libs/background.js:271-280
Reads cookies automatically when the popup opens. — libs/popup.js:345-348
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Work is limited to storage, Facebook request observation, Facebook API requests, and internal messaging. — libs/background.js:1-387
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reads only meta, hidden fb_dtsg, and data-dtsg values as token fallbacks. — libs/content.js:103-125