Is YouTube Quick Keys safe?
YouTube Quick Keys is medium risk. When you press the configured activation key on a YouTube page, YouTube Quick Keys sends Mixpanel an analytics event with the page URL, browser user agent, a persisted extension UUID, and country/city/continent resolved from your IP.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
YouTube page URLs and IP-derived location sent to Mixpanel analytics
When you press the configured activation key on a YouTube page, YouTube Quick Keys sends Mixpanel an analytics event with the page URL, browser user agent, a persisted extension UUID, and country/city/continent resolved from your IP.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You press the configured activation key on a YouTube page.
The extension sends a Mixpanel analytics event containing the current YouTube page URL, browser user agent, persisted extension UUID, and IP-derived location values.
- Current YouTube page URLhttps://www.youtube.com/watch?v=dQw4w9WgXcQ (illustrative)
Shows which YouTube page was open when the activation key was pressed.
- IP-derived locationUnited States, New York, North America (illustrative)
Adds country, city, and continent values resolved from the client IP address before the analytics event is sent.
- Browser and tab contextMozilla/5.0 Chrome/126.0 (illustrative)
Includes browser user-agent details with the page event, linking the action to the browsing environment.
Dynamic analysis confirmed that pressing the activation key triggers tracking for the current YouTube page and that the analytics payload is posted to Mixpanel.
What it can do
Permissions this extension asks for, as declared in version 2.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage