Is YouTube Mini Player safe?

Medium risk

YouTube Mini Player generates a persistent device fingerprint and sends it with every request to the developer's server.

On each YouTube page load, the extension uses bundled FingerprintJS v4.5.1 to generate a stable device identifier (visitorId), which it stores locally and appends as a tracking parameter to all API calls. Every page visit triggers a config fetch to antonkhoteev.com that transmits this fingerprint ID alongside an install-time UUID and the extension version. User interactions such as enabling picture-in-picture mode, viewing the paywall, and submitting ratings also fire GET requests to the same server with the persistent identifier attached.

Anton Khoteevv3.1.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

FingerprintJS Generates Persistent Device ID Sent to Developer Server

DA captured a GET to antonkhoteev.com/khoteev-api/pipy/config carrying a FingerprintJS-derived userId, right after loading YouTube.

FingerprintJS hashes canvas/WebGL/audio/font signals into this ID, letting the server correlate sessions.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open any YouTube page with the extension installed.

No interaction is required; the fingerprinting code runs automatically on page mount.

The extension did this

The extension runs FingerprintJS v4.5.1, generates a stable 32-character device fingerprint, stores it, and sends it to the developer's server.

The hash is calculated once and cached in chrome.storage.local; on subsequent visits the stored value is reused without re-fingerprinting.

02EvidenceCODE COMPARE
The code that does this

generateUserId, FingerprintJS integration

What it actually does
const generateUserId = async => {
 try {
 const fp = await load;
 const result = await fp.get;
 if (result.visitorId) {
 return result.visitorId;
 }
 } catch (e) {}
 return null;
};
03EvidenceFIELD TABLE
Data collected by FingerprintJS and stored as userId
FieldValueWhy it matters
Device fingerprint ID
c3c46173b52097fd436012c4d25414fcA 32-character hex hash of your browser and hardware traits. It stays the same across visits, letting the server link your YouTube sessions.
Canvas rendering signature
Aq6+ACgAAAAA... (base64 canvas snapshot)How your GPU renders specific shapes; contributes to the fingerprint. Differs between devices and graphics drivers.
WebGL renderer string
ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0)Your GPU model and driver version, as reported by WebGL; a high-entropy fingerprint signal.
Audio context fingerprint
124.04347527516074A numeric hash of how your browser processes audio; stable per device.
04EvidenceNETWORK CAPTURE
Captured request
GEThttps://antonkhoteev.com/khoteev-api/pipy/config?userId=c3c46173b52097fd436012c4d25414fc&userUuid=7ef96777-8f6c-4087-a691-7e6d26131a3c&version=3.1.0
05EvidenceTHIRD PARTY LIST
Where the fingerprint ID is transmitted
  • antonkhoteev.com

    Developer's own API server. Receives userId (FingerprintJS hash), userUuid, and extension version on every YouTube page load. Declared in manifest host_permissions.

  • m1.openfpcdn.io

    FingerprintJS npm monitoring endpoint. Receives a GET request approximately 0.1% of the time (Math.random < 1e-3) to report library usage. Operated by Fingerprint Inc.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Config Fetch Transmits Device Fingerprint and Install UUID on Every YouTube Page

DA captured a GET to antonkhoteev.com/khoteev-api/pipy/config carrying userId (FingerprintJS hash), userUuid (install UUID), and version on every YouTube load, before interaction.

Both persist across restarts, tracking your visits.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You load any YouTube page with the extension installed.

The config fetch fires automatically on every page mount with no user interaction required.

The extension did this

The extension immediately sends your device fingerprint ID, install UUID, and extension version to the developer's server as a GET request.

The server returns configuration data (paywall limits, rating prompts) which the extension applies locally.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://antonkhoteev.com/khoteev-api/pipy/config?userId=c3c46173b52097fd436012c4d25414fc&userUuid=7ef96777-8f6c-4087-a691-7e6d26131a3c&version=3.1.0
03EvidenceCODE COMPARE
The code that does this

initConfig, identifiers appended to config URL

What it actually does
const initConfig = async => {
 var _a, _b;
 try {
 const getConfigUrl = new URL("https://antonkhoteev.com/khoteev-api/pipy/config");
 if (userStore.userId)
 getConfigUrl.searchParams.append("userId", userStore.userId);
 if (userStore.userUuid)
 getConfigUrl.searchParams.append("userUuid", userStore.userUuid);
 if ((_b = (_a = chrome.runtime)?.getManifest)?.version)
 getConfigUrl.searchParams.append("version", chrome.runtime.getManifest.version);
 const response = await fetch(getConfigUrl, { method: "GET" });
 const config = await response.json;
 // config.paywall, config.rating, config.activeSubscription applied
 } catch (e) { console.log(e); }
};
04EvidenceFIELD TABLE
Query parameters sent to antonkhoteev.com on every YouTube page load
FieldValueWhy it matters
Device fingerprint ID (userId)
c3c46173b52097fd436012c4d25414fcA 32-character hex hash of browser/hardware traits from FingerprintJS v4.5.1. Stable across restarts; identifies your device persistently.
Install UUID (userUuid)
7ef96777-8f6c-4087-a691-7e6d26131a3cA UUID assigned when the extension is first installed. Unique per installation and persists in chrome.storage.local.
Extension version
3.1.0The installed extension version number, allowing the server to track the extension version in use per user.
05EvidenceTHIRD PARTY LIST
Destination of the config request
  • antonkhoteev.com

    Developer's own API server. Receives userId, userUuid, and version on every YouTube page load, plus paywall-view and rating events. Declared in host_permissions.

Data recipients

antonkhoteev.com
Updated 17 September 2026aebidfeikndkapbilgnhbedgilbcngok