Is Givee.Club - Get games for free! safe?
We analyzed Givee.Club - Get games for free! version 5.0.1's actual code and gave it a 62/100 trust score. This appears purpose-aligned but carries…
Bottom line
This appears purpose-aligned but carries meaningful risk because giveaway sites can direct user-triggered requests through the extension.
What it can access
It runs on two giveaway sites and can contact several other listed sites, while reading giveaway task data but not browser passwords or cookies. [Q1][Q2][Q14]
Security weaknesses
Giveaway page content can direct a privileged request relay to allowlisted sites after a click, creating a confused-deputy risk. [Q16][Q18][Q21]
Signs of misuse
The package shows task data and results returning to the giveaway service, but no clear evidence of unrelated tracking, deception, or harmful use. [Q6][Q12][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has storage and alarm access, runs on two giveaway sites and can contact a defined set of giveaway, social, game and media hosts.
Declares the content-script matches, alarms/storage and explicit host permissions. — manifest.json:12-24,35-50
Which websites can it run on, and can it read or change what appears on those pages?
On Givee.Club and Giveaway.su only, it reads giveaway article markers and data attributes used to identify and complete tasks.
Reads article/event presence plus timestamp, csrf and secret data attributes. — content-script/revealer.js:1-10
Restricts page execution to the two giveaway domains. — manifest.json:12-24
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads only giveaway-specific data attributes and action definitions; no forms or broad DOM text collection. — content-script/revealer.js:1-65
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests storage and alarms only. — manifest.json:35-38
Reads and updates givee.locale, givee.actual and givee.filter. — background.js:66-107
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of these permissions. — manifest.json:35-38
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends giveaway page identifiers to the same service and, after a task click, returns the full allowed-site response to that service's checker services.
Builds a same-host action-list URL from timestamp, csrf, optional secret and extension version. — content-script/revealer.js:7-10,25-31
Encodes the task response and POSTs it with action metadata to the checker URL. — background.js:35-59
Does it download or run code, settings, or instructions supplied by a remote server?
Givee/ Giveaway supplies event content and task instructions, including destination URL, HTTP method, POST body and delay.
Retrieves remote task markup, decodes its data-action JSON and sends the resulting action to the worker. — content-script/revealer.js:25-31,46-64
Uses server-supplied action.task, action.method and action.data to make a request. — background.js:16-34
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It checks Givee.Club for status every three minutes. Cross-site task actions require a user click.
Fetches status on installation and a repeating three-minute alarm. — background.js:66-117
Runs an action only inside the task button click handler. — content-script/revealer.js:46-64
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings or management permissions. — manifest.json:35-38
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
jQuery is minified, while the extension's own background, page and popup logic is readable. No concealed application data was found.
Loads packaged md5, minified jQuery and readable revealer code. — manifest.json:18-21
Core network and messaging behavior is unobfuscated. — background.js:1-130
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Bundled library defines generic script-evaluation helpers. — vendor/jquery-3.6.3.min.js:2
Remote markup is inserted and action JSON is parsed as data; no eval, Function or string timer is used. — content-script/revealer.js:25-64
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Constructs the task-list request from window.location.host and pathname. — content-script/revealer.js:25-31
The content script runs only on the two giveaway sites. — manifest.json:12-24
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Status polling sends an X-Champion version header and processes event data without a generated client ID. — background.js:66-107
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads page-provided CSRF and optional secret values and returns them only to the same giveaway service. It does not read browser cookies or opt task fetches into third-party credentials.
Reads csrf/secret data attributes and sends them to the current giveaway host. — content-script/revealer.js:7-10,25-31
Task fetch options omit credentials:'include'; no cookie API is used. — background.js:19-34
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Contains click handlers for giveaway actions but no input, key or screenshot collection. — content-script/revealer.js:1-65
Can a website or remote server send commands that make the extension take actions?
The giveaway service controls task URL, method and body within the manifest host allowlist. Execution requires a user click, and the current remote task data were not available in the package.
Decodes remote action JSON when the user clicks the action button. — content-script/revealer.js:46-64
Executes the instructed request and returns the response. — background.js:16-59
Limits reachable cross-origin destinations to declared hosts. — manifest.json:39-50
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Removes script elements from returned markup, replaces article content and manages giveaway action buttons. — content-script/revealer.js:25-31,33-64
Restricts this code to Givee.Club and Giveaway.su. — manifest.json:12-24
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It is a user-triggered request relay: remote task data selects an allowlisted URL and optional POST body, and the response goes back to the giveaway service.
Performs the remote-selected GET/POST and sends its response to data.checker. — background.js:16-59
Sets checker to the current giveaway host and starts the action after a click. — content-script/revealer.js:46-64
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no native or system-level permission. — manifest.json:35-50
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Strips script elements from returned markup and parses Base64 action data with JSON.parse. — content-script/revealer.js:25-31,46-64
Extension pages restrict scripts to packaged self resources. — manifest.json:52-53
Can ordinary websites access privileged extension features through messaging or exposed files?
Givee/ Giveaway page content can supply action JSON to a privileged background fetch path. The bridge is limited to those two sites, allowlisted destinations and a user click.
Reads data-action from a clicked page button and sends it to the extension worker. — content-script/revealer.js:46-64
The worker dispatches action messages to the request relay. — background.js:118-130
Restricts content-script sources and fetch destinations. — manifest.json:12-24,39-50
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Locale and last-seen time change the status endpoint and badge behavior. — background.js:66-107
Available actions and their request details come from the live giveaway service. — content-script/revealer.js:25-64
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains event polling and task requests only. — background.js:1-130
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Replaces article markup and handles task buttons without reading or changing forms. — content-script/revealer.js:25-64