Is YouTube Parental Control - Block any content! [QVI] safe?

Low risk

YouTube Parental Control reads your Google My Activity history and profile hourly and uploads it to metricmuse.xyz.

A background job runs every hour using your signed-in Google session. It fetches Google My Activity history and profile details such as gender and birth year, then sends them to metricmuse.xyz, which tells the extension what to collect. The opt-out setting is only reported to the server and does not stop the collection.

TheBestChromeExtensionsv0.0.4Chrome Web Store
22Risk
Who publishes it

HideApp LLC - 37 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
TheBestChromeExtensions
Declared legal entity
HideApp LLC
Website
support.hideapp.info/support/tickets/new

Same store account

37 other listings published from this account, 266k+ users between them. 2 of them carry a finding.

Hulu Ad Skipper100k+MediumDisney Plus Picture in Picture80k+LowHulu Picture In Picture [QVI]20k+LowHBOmax Skipper: skip ads and intros20k+LowHBO Max HQ: change video quality [QVI]10k+MediumHBO Max Picture in Picture [QVI]10k+Low31 more listings in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

thebestchromeextensions.com
Also called by 6 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Hourly job reads Google My Activity and profile data for metricmuse.xyz

Code analysis shows an hourly job reads your Google My Activity and birth year using your signed-in session, then uploads it to metricmuse.xyz on server command, with no opt-out check.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

The hourly alarm fires while you are signed in to Google.

The extension did this

The extension reads your Google activity and profile pages and sends the results to metricmuse.xyz.

The code that does this

Alarm registration and session-authenticated fetch

Readable version

Birthday page fetch

youtube_background.min.js
fetch("https://myaccount.google.com/birthday", {    method: "GET",    credentials: "include"})

Server-driven init request

youtube_background.min.js
postPlainJsonRequest("".concat(Metriq_BASE_ROUTE, "youtube/start"), initData)

Upload of results

youtube_background.min.js
postPlainJsonRequest("".concat(Metriq_BASE_ROUTE, "youtube/upload"), _object_spread_props(Metriq_object_spread({}, data), {
Data the code reads or sends
  • Google My Activity
    batchexecute rpc y3VFHd, services [15,25,26,27,35,55]

    Entries from your Google activity log for several services, over a time range the server picks.

  • Gender and birth year
    birthYear from ac.s.bir.br

    Read from your Google account birthday page.

  • Hashed account email
    mailHash

    A hash of your Google email is sent as the account and profile identifier.

  • Extension and device context
    optedOut: false

    Extension user ID, time offset, browser language, distribution tag and opt-out flag.

When this fires

Every 1 hour

First run 30 minutes after install, then every 60 minutes.

Where the data goes
    • metricmuse.xyz

    Receives init data at /n/youtube/start, issues commands, receives uploads at /n/youtube/upload.

    • myactivity.google.com

    Source of activity history, read with your signed-in session.

    • myaccount.google.com

    Source of gender and birth year.

Opt-out handling

The shareInsights setting is read by isOptedOut() and included in the init request as optedOut. The scraping path shown in the code does not branch on it before fetching Google pages.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 0.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed YouTube Parental Control - Block any content! [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • metricmuse.xyz

    YouTube Parental Control - Block any content! [QVI] sends data to metricmuse.xyz. 12 other extensions we have analysed send data here.

Updated 15 October 2026ngmbhlokkidckgigcocifgbjljbeidhp