Netflix Picture-in-Picture Extension Bundles Default-On Telemetry SDK

Overview

The Chrome extension "Netflix Picture in Picture now for Prime & D+ [QVI]" (store ID: jkmakgpojigahjdalffbkimpnpabelio) with approximately 200,000 installs provides picture-in-picture functionality for streaming sites. Its own code is narrowly scoped: it requests scripting and storage permissions, limited to streaming site hosts, and does not access cookies, credentials, proxy settings, or execute remote scripts. However, the extension bundles a third-party telemetry SDK (TYP 1.83.1) and enables "insight sharing" by default, sending install and usage data to the developer's analytics endpoints. This behavior is not disclosed in the extension description and is unrelated to the PiP function.

How it works

The background worker loads the SDK via importScripts('/js/typ.min.js') (background.js:9). The SDK configuration (typ.min.js:5) reveals collection endpoints:

var config = JSON.parse('{"uL":"https://me3x.online/n/","QL":"28a42b57","xg":"","Ec":"https://me3x.online/"}');

On installation, background.js:38 checks a shareInsights flag in Chrome storage. If not set (default), the extension shows an opt-out banner (baner.js:92). Unless the user clicks "opt-out", the SDK transmits usage data to me3x.online (and possibly metricsmint.quest). The extension's own code (content.js, background.js) contains no credential harvesting, proxy manipulation, or remote code execution.

Payload

The telemetry SDK likely sends installation events, version info, and usage statistics. The exact payload fields could not be confirmed: a sandbox run failed with a path error, and the live endpoints returned HTTP 404 (possibly no longer active). However, the bundled code is sufficient evidence of intent: the extension includes an analytics library that is not part of the PiP feature. This is "bundled unwanted software" as per MalExt, not necessarily malware.

Store status

The extension remains available on the Chrome Web Store. It is classified as "risky" rather than "malicious". Users who value privacy should either avoid the extension or manually opt out via the banner (by clicking the opt-out button) before using it.