Is Shorts scroller, works with Youtube [QVI] safe?
Shorts scroller sends YouTube, U-NEXT, and Crunchyroll account/profile and viewing data to me3x.online.
The extension collects profile, account, subscription, and viewing-history details from YouTube/Google, U-NEXT, and Crunchyroll while the user is signed in. It contacts me3x.online for collection instructions and uploads the results there; its Crunchyroll script also sends account_id, extension_user_id, and customer_email to metricsmint.quest. A default stats script also posts selected identifiers from several other streaming sites to me3x.online unless sharing insights is turned off.
Who publishes itHideApp - 67 other listings from the same operator, 15 of them carrying a finding
HideApp - 67 other listings from the same operator, 15 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
12 other listings published from this account, 29k+ users between them, none of them carrying a finding.
Same operator - 55 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Streaming account IDs auto-sent to me3x.online on 7 sites
We observed the extension sending your streaming profile ID, account ID and country to me3x.online on Shahid, Starzplay, Pluto and four other sites.
The sharing setting defaults to on when you install the extension.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You visit a matched streaming site such as starzplay.com or shahid.mbc.net while signed in.
The extension's stated purpose is scrolling past YouTube Shorts; it also ships a separate content script for these streaming domains.
The extension reads your profile ID, account ID and country from the site's cookies and local storage and POSTs them to me3x.online.
This runs automatically on page load unless you turn off 'Share anonymous viewing insights' in the extension's options page.
- Install ID4d47d622-3b8e-4b41-801c-f3716fa53d04
A persistent ID for your install of the extension, letting me3x.online tie every visit back to the same browser.
- Distribution IDcbanpbegoilokknfjgmdgnbifhaclfpp
An identifier for how the extension reached your browser.
- Your countryGB
Your two-letter country code, read from the streaming site's local storage or a cookie.
- Streaming profile IDab43a640-a9dd-11f1-b146-55e0db4131f0
The ID of the specific viewing profile you're using, useful when a household shares one account.
- Streaming account ID8842193
Your account ID on the streaming service, read from a cookie. Sent on Starzplay and Pluto.
- Content-Type
- application/json
{ "panelist_id": "4d47d622-3b8e-4b41-801c-f3716fa53d04", "dist": "cbanpbegoilokknfjgmdgnbifhaclfpp", "country": "GB", "profile_id": "ab43a640-a9dd-11f1-b146-55e0db4131f0"}The sharing setting defaults to on, and the content script checks only for an explicit opt-out
Readable equivalent
background.jschrome.runtime.onInstalled.addListener(async () => { const { shareInsights } = await chrome.storage.sync.get('shareInsights'); if (shareInsights === undefined) { await chrome.storage.sync.set({ shareInsights: true }); }});Readable equivalent
stats.min.jsasync function isOptedOut() { if (!globalThis.chrome?.storage) return false; const { shareInsights } = await chrome.storage.sync.get('shareInsights'); // Only an explicit false skips the send; true, or no stored value, sends. return shareInsights === false;}- me3x.online
Receives an install ID, distribution ID, and, on matched streaming sites, your viewing profile or account ID and country.
Where it sends data
Destinations our analysis observed Shorts scroller, works with Youtube [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- me3x.onlinewidely used
Shorts scroller, works with Youtube [QVI] sends data to me3x.online. A widely used service: 46 other extensions we have analysed send data here.
- metricsmint.questwidely used
Shorts scroller, works with Youtube [QVI] sends data to metricsmint.quest. A widely used service: 43 other extensions we have analysed send data here.