Is vidIQ Vision for YouTube safe?

Medium risk

vidIQ is medium risk. While signed in to vidIQ, browsing TikTok makes the extension record which videos you watched, how far, and rewatches, with the creator's handle, sound, and video URL, sent to vidIQ's analytics. Controlled by server-side experiment flags.

vidIQv3.216.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

TikTok Watch Behavior Sent to vidIQ Analytics

While signed in to vidIQ, browsing TikTok makes the extension record which videos you watched, how far, and rewatches, with the creator's handle, sound, and video URL, sent to vidIQ's analytics.

Controlled by server-side experiment flags.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You watch a TikTok video while signed in to vidIQ.

This applies to the for-you page, following feed, search results, hashtag pages, and individual video pages.

The extension did this

The extension sends your watch state, the video URL, creator handle, and sound metadata to a vidIQ analytics endpoint.

Three distinct events are reported: when playback starts, when the video completes, and if you rewatch it.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://cfriuxb2f3.execute-api.us-east-1.amazonaws.com/v1/ExtensionAnalytics
Amplitude analytics relay; 200 OK. Three separate requests captured during dynamic analysis: started_watching, completed_watching, rewatched.
Headers
Content-Typeapplication/json
Body
{
  "events": [
    {
      "event_type": "started watching tiktok video",
      "user_properties": {
        "Fetch Override TikTok resalt2": "variant"
      },
      "event_properties": {
        "video name": "POV you're listening to✨",
        "video url": "https://www.tiktok.com/@sofiacamara/video/7613882455048604949",
        "video creator": "sofiacamara",
        "sound name": "original sound",
        "sound author": "sofiacamara",
        "sound url": "https://www.tiktok.com/music/original-sound-7613882455048604949"
      }
    }
  ]
}
03EvidenceFIELD TABLE
Fields transmitted per watch event
FieldValueWhy it matters
Your vidIQ user ID
8421937Links every TikTok video you watch to your vidIQ account.
Video URL
https://www.tiktok.com/@sofiacamara/video/7613882455048604949The full URL of the TikTok video, including the creator's @handle and the numeric video ID.
Creator handle
sofiacamaraThe TikTok username of the person who posted the video.
Watch state
completed_watchingWhether you started watching, watched to the end, or watched it a second time.
Timestamp
1745547912384Millisecond-precision time when each watch event occurred.
Sound name and author
original sound — sofiacamaraThe audio track used in the video and its creator's name.
04EvidenceCODE COMPARE
The code that does this

fetch hook injection gated by TIKTOK_FETCH_OVERRIDE server flag (tiktokDocumentStart.bundle.js)

What it actually does
// tiktokDocumentStart.bundle.js — document_start CS on www.tiktok.com/*
// Queries the remote experiment flag; injects the fetch-override script only
// when the server returns variant.key === 'variant'.

experimentClient.getExperimentValue(FeatureFlags.TIKTOK_FETCH_OVERRIDE)
  .then((result) => {
    if (result && result.variant.key === 'variant') {
      // inject tiktokFetchHandler.bundle.js (WAR) into the page's MAIN world
      const script = document.createElement('script');
      script.src = chrome.runtime.getURL('tiktokFetchHandler.bundle.js');
      document.documentElement.appendChild(script);
      script.parentNode?.removeChild(script);
    }
  });
05EvidenceCODE COMPARE
The code that does this

window.fetch wrapper that intercepts TikTok API responses (tiktokFetchHandler.bundle.js)

What it actually does
// tiktokFetchHandler.bundle.js — injected into MAIN world on www.tiktok.com/*
// Wraps window.fetch to intercept TikTok's internal video-feed API responses.

const INTERCEPTED_PATHS = [
  '/api/recommend/item_list/',   // For You page
  '/api/following/item_list/',   // Following feed
  '/api/post/item_list/',        // User profile videos
  '/api/challenge/item_list/',   // Hashtag page
  '/api/music/item_list/',       // Music page
  '/api/topic/item_list/',       // Topic feed
  '/api/search/general/full/',   // Search results
  '/api/related/item_list/',     // Related videos
  'api/explore/item_list',       // Explore page
];

const PAGE_TYPE_MAP = {
  recommend: 'foryou', following: 'following', post: 'channel',
  challenge: 'hashtag', music: 'music', topic: 'foryou',
  search: 'search', related: 'related', explore: 'explore',
};

const originalFetch = window.fetch;
window.fetch = function (...args) {
  return originalFetch(...args).then(async (response) => {
    const matchedPath = INTERCEPTED_PATHS.find(p => response.url?.includes(p));
    if (matchedPath) {
      const segment = new URL(response.url).pathname.split('/')[2];
      const pageType = PAGE_TYPE_MAP[segment];
      if (pageType) {
        const body = await response.clone().json().catch(() => response.text());
        document.dispatchEvent(new CustomEvent('tiktokAjaxResponse', {
          detail: { url: response.url, data: body, page: pageType },
        }));
      }
    }
    return response;
  });
};
06EvidenceTHIRD PARTY LIST
Destinations for TikTok behavior data
  • cfriuxb2f3.execute-api.us-east-1.amazonaws.com

    AWS API Gateway relay to Amplitude. Receives watch-state events (started/completed/rewatched) with video URL, creator handle, sound metadata. Confirmed in dynamic analysis.

  • api.vidiq.com

    vidIQ's primary API. Receives batched video feed data (IDs, view/like/comment/share counts, author info, hashtags, duration) at api/scraping/tiktok/{apiPath} via POST.

  • api.vidiq.com

    Experiment flag source: api.vidiq.com/experimentation/batch-by-keys controls whether the fetch hook and watch-event collection are active for a given user.

Updated 10 September 2026pachckjkecffpdphbpmfolblodfkgbhl