Is "Apple TV Picture In Picture [QVI]" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is likely false positive with 78% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 44/100.
Evidence context: threat category none; evidence quality moderate.

This extension, 'Apple TV Picture In Picture [QVI]', has 11 findings, all classified as network detections in appletv.min.js and typ.min.js. The findings are titled NET-FETCH-appletv.min.js-3635, NET-FETCH-appletv.min.js-6767, NET-FETCH-typ.min.js-173, and similar variants. These findings only indicate that fetch() calls exist in the code—they do not reveal any actual domain names, URLs, or IP addresses being contacted. For a Picture-in-Picture extension, network requests are expected behavior for detecting video sources and managing playback state.

Crucially, the evidence shows zero malware signatures, zero obfuscation findings, zero credential theft patterns, and zero suspicious IoCs. The findings_summary explicitly states "ioc":"0", "malware-signature":"0", and "obfuscation":"0". Without actual domain extraction showing connections to suspicious servers, these network findings are generic noise from the static analysis tool flagging any fetch() call as a potential concern.

The developer email [email protected] is a generic Gmail address rather than a company domain. While this lacks corporate attribution, many legitimate Chrome extensions from individual developers use personal Gmail addresses. The extension name 'Apple TV Picture In Picture' describes a legitimate browser feature and does not mimic any known popular extension (no typosquatting detected). The description accurately matches the expected functionality.

The strongest counterargument would be that 11 network findings with a generic developer email suggests potential data exfiltration. However, this argument fails because the findings contain no actual domain names—only generic 'fetch detected' markers. Legitimate PiP extensions must make network requests to detect video elements, check for DRM restrictions, and manage playback state. Without evidence of suspicious domains (e.g., data exfiltration endpoints, command-and-control servers, or tracking domains), the network activity is consistent with the extension's stated purpose. The absence of malware signatures, obfuscation, or credential access patterns further supports that this is a false positive driven by overly broad network detection rules.

Key Reasons

• All 11 findings are generic fetch detections without suspicious domain extraction
• Zero malware signatures detected in any file
• Zero obfuscation findings present
• No credential theft or browser hijacking patterns identified
• Extension functionality matches stated description

False Positive Considerations

• Generic network fetch detection without domain extraction
• No malware signatures present
• No obfuscation or credential access patterns
• Legitimate PiP functionality requires network requests