Is Cookie-Editor safe?
We analyzed Cookie-Editor version 1.13.0's actual code and gave it a 76/100 trust score. This is a useful but powerful cookie editor with a…
Bottom line
This is a useful but powerful cookie editor with a domain-permission weakness and no established evidence of misuse.
What it can access
It can read, change, and delete cookies—including login-related cookies—across approved sites, potentially every site, which fits its purpose but is powerful. [Q1][Q4]
Security weaknesses
Its broad parent-domain approval can unintentionally extend cookie access from one site to other sites sharing a hosting domain. [Q2]
Signs of misuse
The package shows no evidence that cookie data leaves the browser, that remote code runs, or that hidden actions occur. [Q6][Q7][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests cookies, tabs, local storage, and side-panel access, with optional website access. Those powers fit a cookie editor, but cookies can be login credentials.
Declares cookies, tabs, storage, and sidePanel, with <all_urls> available as optional host access. — manifest.json:permissions and optional_host_permissions
Checks and requests the exact host plus a wildcard over a hand-calculated parent domain. — interface/lib/permissionHandler.js:48-99
Requests <all_urls> before user-triggered export-all, delete-all, or all-browser-cookie access. — interface/options/options.js:128-193
Which websites can it run on, and can it read or change what appears on those pages?
It can manage cookies on any website the user approves, but it does not inject a page access or read/change webpage page content. Its simple parent-domain algorithm can over-grant a shared hosting domain—for example, approval on foo.github.io includes https://*.github.io/*.
Website access is optional and can cover <all_urls>; no content_scripts entry is declared. — manifest.json:optional_host_permissions
getRootDomainName handles only a short hard-coded list of second-level labels and otherwise takes the last two labels, which mistakes public suffixes such as github.io for a private parent domain. — interface/lib/permissionHandler.js:48-111
Uses the browser cookie API to read, set, and remove cookies; it has no page-DOM operations. — interface/lib/genericCookieHandler.js:22-188
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content-scripts entry and no permission to read page text or form fields; site access is limited to cookie operations. — manifest.json:1-40
Every DOM query is inside the extension's own popup window (its buttons, menus, and export form), not inside a website's page. — interface/popup/cookie-list.js:387-1354
The background script only calls the browser's cookie get/set/remove functions; it never fetches or inspects page content. — cookie-editor.js:101-136
Site access is requested per-domain solely to allow cookie editing; no broader page-reading capability is granted. — interface/lib/permissionHandler.js:79-93
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads and can rewrite or delete website cookies, including HttpOnly authentication cookies and session tokens, for granted hosts. It does not request saved browsing history, bookmarks, or downloads.
Internal messages invoke cookies.getAll, cookies.set, and cookies.remove. — cookie-editor.js:79-136
Displays and edits cookie names, values, domains, paths, expiration, SameSite, Secure, and HttpOnly fields. — interface/lib/cookie.js:125-220
Declares cookies and tabs but not history, bookmarks, or downloads. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write exported cookie data to the system clipboard after the user clicks export. It never reads the clipboard and has no file, location, camera, microphone, or native-application access.
Formats the selected site's cookies and copies them with a temporary textarea and document.execCommand('Copy') after an export click. — interface/popup/cookie-list.js:919-975,1201-1215
Global export similarly writes all accessible cookies to the clipboard after a button click. — interface/options/options.js:180-213
Declares no clipboardRead, file, geolocation, camera, microphone, or nativeMessaging permission. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains fixed sponsor and affiliate destination strings, not network calls. — interface/lib/ads/activeAds.js:1-145
Builds an ordinary clickable ad link locally; no fetch or beacon runs when it is displayed. — interface/popup/cookie-list.js:1277-1327
The outbound link uses target=_blank with rel=noopener noreferrer. — interface/popup/cookie-list.html:ad template
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Every runtime entry point names a packaged local file. — manifest.json:background, action, devtools_page, options_ui
Ad text, dates, browser targeting, and links are fixed in the package rather than remotely configured. — interface/lib/ads/activeAds.js:1-145
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Cookie mutations and clipboard exports are wired to extension form submissions and button clicks. — interface/popup/cookie-list.js:79-438,919-975
All-browser export/delete are click handlers, and deleteAllCookies requires a confirmation prompt. — interface/options/options.js:116-193
Cookie and tab change listeners only forward refresh notifications to connected extension pages. — cookie-editor.js:177-226
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Permissions are limited to cookies, tabs, storage, and side panel — none of these allow changing proxy, search engine, homepage, or managing other extensions. — manifest.json:28-33
The entire background script only forwards cookie read/write/delete commands; no calls to browser settings, proxy, or extension-management APIs appear. — cookie-editor.js:1-200
The main UI code handles cookie editing buttons and clipboard export only; no code references to proxy, homepage, search engine, or extension management exist. — interface/popup/cookie-list.js:1-1354
No 'proxy', 'management', 'bookmarks', or 'webRequest' permission is requested, so the browser would block any attempt to alter those settings. — manifest.json:28-37
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable service worker with direct browser API calls and internal message routing. — cookie-editor.js:1-290
Readable popup, side-panel, and DevTools UI behavior with static ES-module imports. — interface/popup/cookie-list.js:1-1327
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
UI timers use arrow functions and all imports are fixed local modules. — interface/popup/cookie-list.js:1-1327
Background logic contains no dynamic code execution primitive. — cookie-editor.js:1-290
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Queries the current active tab and updates the local currentTab value while the UI is running. — interface/popup/cookieHandlerPopup.js:13-120
Uses currentTab.url only as the scope for cookies.getAll. — interface/lib/genericCookieHandler.js:22-41
No history permission is declared. — manifest.json:permissions
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Generates random UUIDs with crypto.getRandomValues. — interface/lib/guid.js:4-20
Uses a GUID as the name of an internal runtime port and to suppress its own option-change echo. — interface/lib/optionsHandler.js:19-36
Uses another GUID only to make unique element IDs in the open cookie editor. — interface/lib/cookie.js:14-23,125-220
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Cookie data flows only between browser.cookies and the local extension UI. — interface/lib/genericCookieHandler.js:22-211
Explicit export actions format loaded cookies and copy them locally. — interface/popup/cookie-list.js:919-975,1201-1215
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Input and key handlers operate inside the extension popup on cookie-editing controls. — interface/popup/cookie-list.js:49-438
No content script, clipboardRead, tabCapture, desktopCapture, or camera/microphone access is declared. — manifest.json:1-end
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Message actions implement cookie and permission operations for internal extension callers. — cookie-editor.js:9-153
No externally_connectable, content_scripts, or web_accessible_resources entry exists. — manifest.json:1-end
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Defines a sponsor link and date-bounded affiliate promotions for several services. — interface/lib/ads/activeAds.js:1-145
Randomly selects an eligible bundled promotion, respects an ads option, and records dismissal dates locally. — interface/lib/ads/adHandler.js:1-172
Renders the chosen promotion only in the extension interface. — interface/popup/cookie-list.js:1277-1327
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable, content_scripts, or web_accessible_resources. — manifest.json:1-end
Internal runtime message listener exposes cookie operations only to extension contexts. — cookie-editor.js:9-153
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Each bundled promotion specifies supported browsers, refresh days, and optional start/end dates. — interface/lib/ads/activeAds.js:1-145
Checks browser, date range, user preference, and locally stored dismissal time before choosing a promotion. — interface/lib/ads/adHandler.js:20-172
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Populates the extension's own cookie-editor form fields (name, value, domain, path, expiration) with current cookie data for display in the popup. — interface/lib/cookie.js:156-190
Update methods (updateName, updateValue, updateDomain, etc.) refresh the extension's own UI card after a cookie is edited—no web-page form is touched. — interface/lib/cookie.js:248-330
No content scripts, no externally_connectable, and no permissions that would let the extension reach into a web page's DOM or alter its forms. — manifest.json:1-40