Is xMetaCene safe?

Medium risk

xMetaCene sends your Twitter/X cookie and engagement activity to x.metacene.io.

On Twitter/X pages, xMetaCene reads the non-HttpOnly twid cookie and sends it with posting, liking, following, and notification activity to its backend. The extension also fetches notice content from the same backend and inserts the returned HTML into Twitter/X pages.

xMetaCenev2.0.4Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Twitter/X twid cookie and engagement activity sent to x.metacene.io

On Twitter/X pages, xMetaCene can read your non-HttpOnly twid cookie and send it with engagement details to x.metacene.io/cmd.php, including tweet or reply text, followed or liked account data, and the cookie value.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You interact with Twitter/X content while the extension is installed.

The extension did this

The extension reads the twid cookie and sends it with engagement details to x.metacene.io.

Captured request
POSThttps://x.metacene.io/cmd.php
Fields in the request
  • Your Twitter/X cookie
    u=1234567890 (illustrative)

    The twid cookie can link the request to a Twitter/X account session when it is readable by the extension.

  • Text you submit
    Thanks for the update (illustrative)

    Tweet or reply text can reveal the content you typed during the engagement action.

  • Twitter/X page path
    /example/status/1234567890 (illustrative)

    Liked or followed account path data can describe which account or tweet you interacted with.

What it can do

Permissions this extension asks for, as declared in version 2.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Read and change your data on metacene.io

    https://*.metacene.io/*

  • Read and change your data on mixmarvel-sdk.com

    https://*.mixmarvel-sdk.com/*

  • Read and change your data on mantle.xyz

    https://*.mantle.xyz/

  • Read and change your data on zora.energy

    https://*.zora.energy/

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Keep running in the background while your browser is open

    background

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed xMetaCene contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • x.metacene.io

    xMetaCene sends data to x.metacene.io. No other extension we have analysed sends data here.

Updated 21 September 2026igimfdmnnijclcfdgimooedbealfpndj