Is 1of10.com - Optimization Tool For Youtube safe?

Medium risk

1of10.com - Optimization Tool For Youtube assigns a persistent device ID and transmits it with browsing analytics to 1of10.com servers.

The extension injects a content script into YouTube pages that generates and stores a device UUID in youtube.com's localStorage, making it readable by YouTube's own page scripts. On each watch page, the device ID is sent alongside browser type, OS, screen dimensions, language, and plan tier to 1of10.com's analytics endpoint. The extension also scrapes live view counts from the YouTube DOM and forwards them to 1of10.com on page load.

1of10v5.3.5Chrome Web Store
45Risk
Who publishes it

1 of 10 Media Inc. - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
1of10
Declared legal entity
1 of 10 Media Inc.
Registered address
Villeray, Montréal, QC H2R 1N7, CA

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

YouTube UUID Sent to 1of10 Analytics

MediumunwantedCWE-359Dynamic sandbox

Using 1of10 controls on YouTube creates a persistent oot_device_id in YouTube localStorage, sent with browser, OS, screen, language, plan, and video context to 1of10.com.

What actually happens

You did this

You click a 1of10 panel control while using YouTube.

The extension did this

The extension reads or creates a persistent browser identifier and sends it with the analytics event.

The same value is stored in YouTube localStorage under the oot_device_id key.

Fields constructed for the analytics event

  • Persistent extension ID
    ext_k4m9q2v1p9lqma2x7b6

    This lets repeated 1of10 activity in the same browser profile be tied together over time.

  • 1of10 account context
    user_73918462, plan pro

    If you are signed in, the event can be associated with your 1of10 account and plan tier.

  • Browser and display context
    Chrome on macOS, 1920x1080, en-US, dark mode off

    This describes your browser environment and makes the event easier to separate from other users.

  • Clicked YouTube item
    video dQw4w9WgXcQ, channel UC_x5XG1OV2P6uZZ5FSM9Ttw

    This records which video or channel was attached to the 1of10 control you clicked.

Captured request

POSThttps://1of10.com/api/monitoring/analytics/track
Headers
Content-Type
application/json

The code that does this

The content script creates the ID and sends it through the analytics path

Readable version

Readable content-script.js creates oot_device_id and sends analytics

content-script.js
var Z = function() {    var e = localStorage.getItem("oot_device_id");    return e || (e = "ext_" + Math.random().toString(36).substring(2) + Date.now().toString(36), localStorage.setItem("oot_device_id", e)), e  },  X = function() {    var e = K(Y().mark((function e() {      var t;      return Y().wrap((function(e) {        for (;;) switch (e.prev = e.next) {          case 0:            return e.prev = 0, e.next = 3, chrome.storage.local.get(["userId", "plan", "loggedIn"]);          case 3:            if (!(t = e.sent).loggedIn) {              e.next = 6;              break            }            return e.abrupt("return", {              userId: t.userId || null,              plan: t.plan || null            });          case 6:            e.next = 10;            break;          case 8:            e.prev = 8, e.t0 = e.catch(0);          case 10:            return e.abrupt("return", {              userId: null,              plan: null            });          case 11:          case "end":            return e.stop()        }      }), e, null, [        [0, 8]      ])    })));    return function() {      return e.apply(this, arguments)    }  }(),  J = function() {    var e, t, n = navigator.userAgent,      r = "unknown";    n.includes("Chrome") ? r = "Chrome" : n.includes("Firefox") ? r = "Firefox" : n.includes("Safari") ? r = "Safari" : n.includes("Edge") && (r = "Edge");    var o = "unknown";    n.includes("Windows") ? o = "Windows" : n.includes("Mac") ? o = "macOS" : n.includes("Linux") ? o = "Linux" : n.includes("Android") ? o = "Android" : n.includes("iOS") && (o = "iOS");    var a = null === (e = window.screen) || void 0 === e ? void 0 : e.width,      i = null === (t = window.screen) || void 0 === t ? void 0 : t.height,      l = document.documentElement.hasAttribute("dark");    return {      browser: r,      os: o,      screen_width: a,      screen_height: i,      language: navigator.language,      yt_dark_mode: l    }  },  ee = function() {    var e = K(Y().mark((function e(t) {      var n, r, o, a, i, l, u, c = arguments;      return Y().wrap((function(e) {        for (;;) switch (e.prev = e.next) {          case 0:            return n = c.length > 1 && void 0 !== c[1] ? c[1] : {}, e.prev = 1, e.next = 4, W("monitoring/analytics/track");          case 4:            return r = e.sent, e.next = 7, X();          case 7:            return o = e.sent, a = o.userId, i = o.plan, l = Z(), u = J(), e.next = 14, U(r, {              method: "POST",              headers: {                "Content-Type": "application/json"              },              body: {                event: t,                user_id: a,                device_id: l,                properties: $($({                  extension_version: chrome.runtime.getManifest().version,                  plan: i                }, u), n)              }            });          case 14:            e.next = 18;            break;          case 16:            e.prev = 16, e.t0 = e.catch(1);          case 18:          case "end":            return e.stop()        }      }), e, null, [        [1, 16]      ])    })));    return function(t) {      return e.apply(this, arguments)    }  }(),  te = "ext_similar_thumbnails_clicked";

Readable service-worker.js sends the final HTTP request

service-worker.js
case 111:  if (e.prev = 111, (d = t.path) && !d.includes("://")) {    e.next = 115;    break  }  throw new Error("Invalid path - must be a relative path");case 115:  return v = d.startsWith("/") ? d.slice(1) : d, m = "".concat(u, "/").concat(v), g = {    method: t.method || "GET",    headers: t.headers || {      "Content-Type": "application/json"    }  }, t.body && (g.body = JSON.stringify(t.body)), t.credentials && (g.credentials = t.credentials), e.next = 122, fetch(m, g);case 122:  if (w = e.sent, S = null, !(j = w.headers.get("content-type")) || !j.includes("application/json")) {    e.next = 130;    break  }  return e.next = 128, w.text();case 128:  (O = e.sent) && (S = JSON.parse(O));case 130:  c = {    success: !0,    status: w.status,    data: S  }, e.next = 136;  break;case 133:  e.prev = 133, e.t5 = e.catch(111), c = {    success: !1,    error: e.t5.message  };case 136:case 137:  return e.abrupt("break", 138);

Destination reached by the analytics path

    • 1of10.com

    Receives monitoring analytics events from the 1of10 extension, including the persistent device_id and event properties constructed in content-script.js.

Where it sends data

Destinations our analysis observed 1of10.com - Optimization Tool For Youtube contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 1of10.com

    1of10.com - Optimization Tool For Youtube sends data to 1of10.com. No other extension we have analyzed sends data here.

Updated 30 September 2026gkfdnmclhbgbidnpmimfdobgjpeblckn