Inspect the extension's network requests in your browser's developer tools while it's active, specifically looking for outbound data to unfamiliar domains that contain your session cookies or authentication tokens. If you see your cookies being sent to a server that isn't the video host, the extension is stealing them.
Video downloader cookies and the real permissions, not the description
Many video downloader extensions claim they only need access to the site you are trying to "download videos" from, but the manifest file may grant far broader reach. To see the real permissions, open your browser's extension management page (chrome://extensions in Chrome, about:addons in Firefox, edge://extensions in Edge). Click "Details" on the extension (in Chrome/Edge) or the extension name (in Firefox), then look for a section labeled "Permissions," "Site access," or "Permissions and data." If you see entries like "Read and change all your data on all websites" or "Access your data on all websites," the extension can read every cookie you have, including login tokens for banking, email, and social media. A legitimate tool for downloading YouTube videos should only need access to YouTube.com and perhaps a CDN domain, not every site you visit. If the permission list includes "cookies" or "webRequest" alongside broad host access, that is a strong red flag. You can also view the raw manifest.json by enabling developer mode in the extensions page, clicking the extension’s ID link, and opening the "source" folder. Search for "permissions" and "host_permissions" to see the exact list. If it includes "" or a wildcard like "*://*/*", the extension can see and send cookies from any site, so consider switching to trusted online video downloaders you should be using now that require no risky browser permissions.
Outbound network traffic and cookie exfiltration
Even with broad permissions, the only definitive proof of theft is seeing your cookies leave your browser. Open your browser’s developer tools (F12), go to the "Network" tab, and reload the page on a video site. Keep the dev tools open while you trigger the extension, click a download button or start a capture. In the Network panel, look for calls to domains that are not the video host (e.g., not YouTube.com, vimeo.com, or the CDN serving the video file). Click each suspicious call and inspect the "Request Headers" section. If you see a "Cookie" header containing your session token or authentication cookie for a different site (like Google.com or Facebook.com), the extension is exfiltrating it. To narrow the search, use the filter bar to show only "XHR" or "Fetch" calls, or type the name of a cookie you know (e.g., "sessionid") into the search box. For extensions that download videos from a specific site, a clean call should only include cookies for that site itself, never for unrelated domains. If you find a call sending your reddit.com login cookie to a server named "tracker.example.net," that is theft. The extension does not need that cookie to "download locked videos from any website"; it needs it only to impersonate you elsewhere.
When the extension is clean but still looks suspicious
Not every strange call is malicious. A legitimate extension may send analytics data (e.g., to google-analytics.com), check for license updates (e.g., to a vendor’s API), or fetch a CDN resource (e.g., from cloudflare.com or unpkg.com). The key difference is the payload. Analytics calls typically send a random ID or version number, not your full cookies. License checks send only an extension ID or a hardware hash. CDN fetches are static files, no cookies at all. To distinguish these from cookie harvesting, examine the "Response" tab of the call: a benign analytics endpoint returns a pixel or a JSON blob, not a command to redirect your session. You can also use the "Initiator" column in the Network panel to see which line of the extension’s background script triggered the call. If the initiator is a script from the video site itself (like a video player), the call is likely part of the download process. If the initiator is a file named "background.js" or "content.js" from the extension, and the call carries your cookies to an unknown domain, treat it as theft. Finally, test the extension in a clean browser profile with no logged-in accounts, if it still makes the same calls, it is not stealing cookies, because there are none to steal.
Cookie theft from browser extensions is invisible in a permissions list but undeniable in the network log: a session token sent to an unknown server is the only proof that matters.
