Is Crunchyroll Speeder: adjust playback speed [QVI] safe?
Crunchyroll Speeder reads your Crunchyroll account profile, watch history and subscriptions and uploads them to me3x.online.
On crunchyroll.com while you are logged in, the extension uses your session cookies to obtain an access token, then follows a command list from me3x.online to read profiles, continue-watching history and subscription data and upload it. It also sends your account email, profile ID and a persistent extension ID to metricsmint.quest. A shareInsights setting defaults to on, and opting out is passed to the server as a flag rather than stopping collection locally.
Who publishes itHideApp - 106 other listings from the same operator, 14 of them carrying a finding
HideApp - 106 other listings from the same operator, 14 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
39 other listings published from this account, 100k+ users between them. 3 of them carry a finding.
Same operator - 67 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Trades your Crunchyroll login cookies for an account API token in the background
When you open a Crunchyroll page while logged in, the extension reads your session cookies and mints a fresh access token via Crunchyroll's login endpoint, unprompted.
Observed twice; the token is then used on third-party API calls.
What actually happens
You open a Crunchyroll page while signed in.
No click or opt-in is needed beyond being logged into crunchyroll.com.
The extension reads your session cookies and exchanges them for a Crunchyroll account access token.
It posts your device_id cookie with a cookie-grant flag to Crunchyroll's token endpoint and stores the returned token for later account API calls.
Captured request
Observed during dynamic analysis: the request auto-fires from the extension content script on navigation to a crunchyroll.com page with a login cookie present, reproduced across two independent runs. The device_id value shown is a planted marker, confirming the value originates from the cookie the extension reads. The endpoint returned an access_token to the extension when a valid session was present.
- Content-Type
- application/x-www-form-urlencoded
- Authorization
- Basic bm9haWhkZXZtXzZpeWcwYThsMHE6
device_id=CANARY_DEVICE_12345&device_type=Chrome&grant_type=etp_rt_cookieWhy you can't catch this in DevTools
The Authorization header on the token request is a Base64 Basic credential. Decoded, it is Crunchyroll's public web-client identifier with an empty password, used to mint a user-scoped token from session cookies. It is a public client identifier, not a private vendor credential.
Authorization: Basic noaihdevm_6iyg0a8l0q:The code that does this
Cookie-to-token exchange and where the resulting token is reused
Token mint from the device_id cookie
crunchyroll.min.js:5898var getConfigTokens = function() { return async function getConfigTokens(profileId) { var body = { device_id: getDeviceIdFromCookies(), device_type: "Chrome", grant_type: "etp_rt_cookie" }; if (profileId) { body.profile_id = profileId; body.grant_type = "refresh_token_profile_id"; } var formData = convertObjectToFormData(body); return Request_postRequest(buildTokensUrl(), formData); };}();var getDeviceIdFromCookies = function() { return getCookie("device_id") || parseCookies().device_id;};var buildTokensUrl = function() { return "".concat(MAIN_URL, "/auth/v1/token");};Basic credential on the mint, Bearer credential on subsequent account reads
crunchyroll.min.js:5003// postRequest (token mint) -> crunchyroll.min.js:5003options = { headers: { Authorization: "Basic bm9haWhkZXZtXzZpeWcwYThsMHE6", // noaihdevm_6iyg0a8l0q: "Content-Type": "application/x-www-form-urlencoded" }, method: "POST", body: formData.toString()};// getRequest (account API reads) -> crunchyroll.min.js:4943var token = await getUserToken();options = { headers: { Authorization: "Bearer ".concat(token) }, method: "GET"};What the token request reads and what the resulting token unlocks
- Your Crunchyroll device cookiedevice_id=8f3c1a2e-7b40-4d11-9c5a-2e6f0b9d1a44
The device_id cookie set by your Crunchyroll login is read and used as the basis for minting the token.
- Logged-in stateajs_user_id present (logged in)
The extension detects you are signed in before minting, so the token reflects your account.
- Account access tokenaccess_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
The returned Bearer token grants read access to your Crunchyroll account profile, watch history, and subscription data.
About the credential used
The Basic credential on the token request decodes to noaihdevm_6iyg0a8l0q:, which is Crunchyroll's own public web-client identifier with an empty password. It is not a private credential extracted from Crunchyroll. The finding is that the extension mints and reuses an account-scoped token from your session cookies on its own, separate from any feature you initiated.
Where it sends data
Destinations our analysis observed Crunchyroll Speeder: adjust playback speed [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- metricsmint.questwidely used
Crunchyroll Speeder: adjust playback speed [QVI] sends data to metricsmint.quest. A widely used service: 60 other extensions we have analyzed send data here.
- me3x.onlinewidely used
Crunchyroll Speeder: adjust playback speed [QVI] sends data to me3x.online. A widely used service: 58 other extensions we have analyzed send data here.