Is 1of10.com - Optimization Tool For Youtube safe?

Medium risk

1of10.com - Optimization Tool For Youtube assigns a persistent device ID and transmits it with browsing analytics to 1of10.com servers.

The extension injects a content script into YouTube pages that generates and stores a device UUID in youtube.com's localStorage, making it readable by YouTube's own page scripts. On each watch page, the device ID is sent alongside browser type, OS, screen dimensions, language, and plan tier to 1of10.com's analytics endpoint. The extension also scrapes live view counts from the YouTube DOM and forwards them to 1of10.com on page load.

1of10v5.2.44Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

YouTube UUID Sent to 1of10 Analytics

Using 1of10 controls on YouTube creates a persistent oot_device_id in YouTube localStorage, sent with browser, OS, screen, language, plan, and video context to 1of10.com.

Being under the YouTube origin, page scripts can read it too.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click a 1of10 panel control while using YouTube.

The extension did this

The extension reads or creates a persistent browser identifier and sends it with the analytics event.

The same value is stored in YouTube localStorage under the oot_device_id key.

02EvidenceFIELD TABLE
Fields constructed for the analytics event
FieldValueWhy it matters
Persistent extension ID
ext_k4m9q2v1p9lqma2x7b6This lets repeated 1of10 activity in the same browser profile be tied together over time.
1of10 account context
user_73918462, plan proIf you are signed in, the event can be associated with your 1of10 account and plan tier.
Browser and display context
Chrome on macOS, 1920x1080, en-US, dark mode offThis describes your browser environment and makes the event easier to separate from other users.
Clicked YouTube item
video dQw4w9WgXcQ, channel UC_x5XG1OV2P6uZZ5FSM9TtwThis records which video or channel was attached to the 1of10 control you clicked.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://1of10.com/api/monitoring/analytics/track
Headers
Content-Typeapplication/json
04EvidenceCODE COMPARE
The code that does this

The content script creates the ID and sends it through the analytics path

What it actually does
Readable content-script.js creates oot_device_id and sends analyticscontent-script.js
var Z = function() {
    var e = localStorage.getItem("oot_device_id");
    return e || (e = "ext_" + Math.random().toString(36).substring(2) + Date.now().toString(36), localStorage.setItem("oot_device_id", e)), e
  },
  X = function() {
    var e = K(Y().mark((function e() {
      var t;
      return Y().wrap((function(e) {
        for (;;) switch (e.prev = e.next) {
          case 0:
            return e.prev = 0, e.next = 3, chrome.storage.local.get(["userId", "plan", "loggedIn"]);
          case 3:
            if (!(t = e.sent).loggedIn) {
              e.next = 6;
              break
            }
            return e.abrupt("return", {
              userId: t.userId || null,
              plan: t.plan || null
            });
          case 6:
            e.next = 10;
            break;
          case 8:
            e.prev = 8, e.t0 = e.catch(0);
          case 10:
            return e.abrupt("return", {
              userId: null,
              plan: null
            });
          case 11:
          case "end":
            return e.stop()
        }
      }), e, null, [
        [0, 8]
      ])
    })));
    return function() {
      return e.apply(this, arguments)
    }
  }(),
  J = function() {
    var e, t, n = navigator.userAgent,
      r = "unknown";
    n.includes("Chrome") ? r = "Chrome" : n.includes("Firefox") ? r = "Firefox" : n.includes("Safari") ? r = "Safari" : n.includes("Edge") && (r = "Edge");
    var o = "unknown";
    n.includes("Windows") ? o = "Windows" : n.includes("Mac") ? o = "macOS" : n.includes("Linux") ? o = "Linux" : n.includes("Android") ? o = "Android" : n.includes("iOS") && (o = "iOS");
    var a = null === (e = window.screen) || void 0 === e ? void 0 : e.width,
      i = null === (t = window.screen) || void 0 === t ? void 0 : t.height,
      l = document.documentElement.hasAttribute("dark");
    return {
      browser: r,
      os: o,
      screen_width: a,
      screen_height: i,
      language: navigator.language,
      yt_dark_mode: l
    }
  },
  ee = function() {
    var e = K(Y().mark((function e(t) {
      var n, r, o, a, i, l, u, c = arguments;
      return Y().wrap((function(e) {
        for (;;) switch (e.prev = e.next) {
          case 0:
            return n = c.length > 1 && void 0 !== c[1] ? c[1] : {}, e.prev = 1, e.next = 4, W("monitoring/analytics/track");
          case 4:
            return r = e.sent, e.next = 7, X();
          case 7:
            return o = e.sent, a = o.userId, i = o.plan, l = Z(), u = J(), e.next = 14, U(r, {
              method: "POST",
              headers: {
                "Content-Type": "application/json"
              },
              body: {
                event: t,
                user_id: a,
                device_id: l,
                properties: $($({
                  extension_version: chrome.runtime.getManifest().version,
                  plan: i
                }, u), n)
              }
            });
          case 14:
            e.next = 18;
            break;
          case 16:
            e.prev = 16, e.t0 = e.catch(1);
          case 18:
          case "end":
            return e.stop()
        }
      }), e, null, [
        [1, 16]
      ])
    })));
    return function(t) {
      return e.apply(this, arguments)
    }
  }(),
  te = "ext_similar_thumbnails_clicked";
Readable service-worker.js sends the final HTTP requestservice-worker.js
case 111:
  if (e.prev = 111, (d = t.path) && !d.includes("://")) {
    e.next = 115;
    break
  }
  throw new Error("Invalid path - must be a relative path");
case 115:
  return v = d.startsWith("/") ? d.slice(1) : d, m = "".concat(u, "/").concat(v), g = {
    method: t.method || "GET",
    headers: t.headers || {
      "Content-Type": "application/json"
    }
  }, t.body && (g.body = JSON.stringify(t.body)), t.credentials && (g.credentials = t.credentials), e.next = 122, fetch(m, g);
case 122:
  if (w = e.sent, S = null, !(j = w.headers.get("content-type")) || !j.includes("application/json")) {
    e.next = 130;
    break
  }
  return e.next = 128, w.text();
case 128:
  (O = e.sent) && (S = JSON.parse(O));
case 130:
  c = {
    success: !0,
    status: w.status,
    data: S
  }, e.next = 136;
  break;
case 133:
  e.prev = 133, e.t5 = e.catch(111), c = {
    success: !1,
    error: e.t5.message
  };
case 136:
case 137:
  return e.abrupt("break", 138);
05EvidenceTHIRD PARTY LIST
Destination reached by the analytics path
  • 1of10.com

    Receives monitoring analytics events from the 1of10 extension, including the persistent device_id and event properties constructed in content-script.js.

Data recipients

1of10.com
Updated 17 September 2026gkfdnmclhbgbidnpmimfdobgjpeblckn