Is Prime Video Speeder: adjust playback speed [QVI] safe?

Medium risk

Prime Video Speeder collects Amazon account details, email address, and viewing history and transmits them to me3x.online and metricsmint.quest.

On every page load on Amazon and Prime Video domains, the extension reads the signed-in account ID, profile ID, Prime membership status, country, and browser settings and sends them to me3x.online. It also fetches the user's contact page to extract their email address and sends it base64-encoded to metricsmint.quest. When a remote server command instructs it to, the extension additionally uploads full viewing history, profile names, age-group preferences, and active Prime channel subscriptions with pricing to me3x.online. These behaviors are enabled by default and require the user to actively opt out via hidden storage keys.

dogooodappv1.1.36Chrome Web Store
45Risk
Who publishes it

HideApp - 67 other listings from the same operator, 15 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
dogooodapp
Declared legal entity
HideApp
Registered address
1021 East Lincolnway, Cheyenne, WY 82001, US
Registered contact
HideApp LLC
Website
support.hideapp.info/support/tickets/new

Same store account

13 other listings published from this account, 234k+ users between them. 2 of them carry a finding.

Ad Skipper for Prime Video90k+MediumSpeeder that works with Disney Plus [QVI]40k+LowNetflix Skipper: skip intros, recaps & more [QVI]30k+MediumPeacock TV Skipper: skip ads, intros & more [QVI]20k+LowSkip ads and intros, works with Disney Plus [QVI]10k+LowHBO Max Speeder: adjust playback speed [QVI]10k+Low7 more listings in the relationship graph, on paid plans →

Same operator - 54 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Amazon Prime Freevee Skipper: skip ads, intros & more [QVI]
same registered address
30k+Low
HBO Max Picture in Picture [QVI]
same registered address
10k+Low
Crunchyroll: Picture in Picture [QVI]
same registered address
60k+Medium
UltraWide Streaming: custom ratios [QVI]
same registered address
20k+Low
FindFlix : see Netflix hidden categories [QVI]
same registered address
4k+Low
HBO Max Extended: tools to fix HBO [QVI]
same registered contact
4k+Low48 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon Remember Me is enabled on sign-in forms

The extension's Amazon content script changes sign-in forms: if a Remember Me control is present and unchecked, it checks it; if absent, it adds a rememberMe=true field, so sign-in requests a persistent session without a separate prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an Amazon sign-in page.

The extension did this

The extension changes the sign-in form so Remember Me is submitted as enabled.

The verified code path either checks an existing control or creates a rememberMe=true field.

Concrete sign-in fields changed by the content script
  • Remember Me checkbox
    checked=true

    This controls whether Amazon is asked to keep your sign-in active after login.

  • Remember Me form value
    type=hidden; name=rememberMe; value=true

    If the visible control is missing, this extra form value can still request a persistent session.

Page DOM modified

The extension adds a rememberMe=true field when the sign-in form does not already contain one.

Target
an Amazon sign-in form
Before
<form name="signIn" method="post">  <input type="email" name="email">  <input type="password" name="password"></form>
After the extension changed it
<form name="signIn" method="post">  <input type="email" name="email">  <input type="password" name="password">  <input type="hidden" name="rememberMe" value="true"></form>
The code that does this

The shipped Amazon content script changes the sign-in form

Readable version

Readable copy of the same function

deobfuscated/amazon.min.js
var LOG_NAMESPACE = "KeepSigned";function checkRememberCheckbox() {    try {        var signInForm = document.querySelectorAll('form[name="signIn"]');        signInForm.forEach(function(form) {            var rememberMeInput = form.querySelector('input[name="rememberMe"]');            if (rememberMeInput) {                if (rememberMeInput.checked === false) {                    rememberMeInput.checked = true;                }            } else {                var rememberMeInput1 = document.createElement("input");                rememberMeInput1.type = "hidden";                rememberMeInput1.name = "rememberMe";                rememberMeInput1.value = "true";                form.appendChild(rememberMeInput1);            }        });    } catch (e) {        (0,_Logger__WEBPACK_IMPORTED_MODULE_0__/* .amazonLogger */ .P)(LOG_NAMESPACE, "exception: ".concat(e));    }}

Readable copy of the entry point call

deobfuscated/amazon.min.js
await run();(0,_Resolver_Hunters_Amazon_Site_Common_KeepSigned_ts__WEBPACK_IMPORTED_MODULE_1__/* .checkRememberCheckbox */ .H)();

Where it sends data

Destinations our analysis observed Prime Video Speeder contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • me3x.onlinewidely used

    Prime Video Speeder sends data to me3x.online. A widely used service: 46 other extensions we have analysed send data here.

  • metricsmint.questwidely used

    Prime Video Speeder sends data to metricsmint.quest. A widely used service: 43 other extensions we have analysed send data here.

Updated 30 September 2026mifkpohchhbpnbmnohoknippibohglke