Is Tubi Speeder: adjust playback speed [QVI] safe?

Medium risk

Tubi Speeder sends Tubi profile identifiers, continue-watching history, and playback events to me3x.online.

When you use Tubi, the extension reads your Tubi account and profile identifiers and can send requested profile and continue-watching history to me3x.online. It also uploads playback and advertising events with a stable extension user identifier by default.

Awesome Extensionsv1.0.19Chrome Web Store
45Risk
Who publishes it

HideApp - 69 other listings from the same operator, 15 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Awesome Extensions
Declared legal entity
HideApp
Registered address
1021 East Lincolnway, Cheyenne, WY 82001, US
Registered contact
HideApp LLC
Website
support.hideapp.info/support/tickets/new

Same store account

6 other listings published from this account, 124k+ users between them. 3 of them carry a finding.

Crunchyroll: Picture in Picture [QVI]60k+MediumWatch Party for Disney Plus30k+MediumCrunchyroll Speeder: adjust playback speed [QVI]30k+MediumCrunchyroll Ad Skipper [QVI]3k+LowApple TV Picture In Picture [QVI]670LowHide Spoilers works with Paramount Plus [QVI]2Low

Same operator - 63 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

HBO Max Extended: tools to fix HBO [QVI]
same registered contact
4k+Low
HBO Max Speeder: adjust playback speed [QVI]
same registered address
10k+Low
UltraWide Streaming: custom ratios [QVI]
same registered address
20k+Low
Netflix Skipper: skip intros, recaps & more [QVI]
same registered address
30k+Medium
Amazon Prime Freevee Skipper: skip ads, intros & more [QVI]
same registered address
30k+Low
HBO Max Picture in Picture [QVI]
same registered address
10k+Low57 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Tubi playback and ad events are sent to me3x.online with user IDs

Using Tubi with the extension installed sends playback and advertising events to me3x.online, including Tubi resource URLs, browsing or viewing-event history, and extension storage identifiers like a user ID.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Uses Tubi with the extension installed

The extension did this

Uploads Tubi playback and advertising events to me3x.online with stable user identifiers

Captured request
POSThttps://me3x.online/n/tubi/upload-event
Fields in the request
  • Your Tubi viewing activity
    adStart for a Tubi video (illustrative)

    Playback and advertising event history can describe what you watched or interacted with on Tubi.

  • Tubi resource URL
    https://youboranqs.example/init?contentId=12345 (illustrative)

    Resource URLs and their query parameters can reveal the video or advertising event being processed.

  • Extension storage identifier
    d7f3a1b2-4c9e-4c2a-9d21-6b34a7f8c901 (illustrative)

    A stable extension user ID links multiple playback and advertising events to the same browser profile.

Observation

Dynamic analysis confirmed the upload path and the default shareInsights setting, while the database evidence did not include a captured request body to publish.

Where it sends data

Destinations our analysis observed Tubi Speeder: adjust playback speed [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • me3x.onlinewidely used

    Tubi Speeder: adjust playback speed [QVI] sends data to me3x.online. A widely used service: 46 other extensions we have analysed send data here.

Updated 30 September 2026pjchilcdicpfbnppopggnllaodiepofh