Chrome Web StoreDo not install
Code review: critical (v0.7.1)
Our reviewer read version 0.7.1 of this extension and confirmed malicious behaviour. 5 security findings documented below. Do not install it. Remove it if you already have it.
22 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
FindFlix : see Netflix hidden categories [QVI], used by 4,000 people, is rated malicious by Extension Auditor. Our code review reported 5 findings (4 critical, 1 medium), led by data exfiltration. It comes from a trusted publisher and was last updated in May 2026.
Key findings
- Critical
Data Exfiltration
The extension hard-codes [domain withheld] as its BASE_ROUTE — a third-party domain with no affiliation to the publisher's declared website ([domain withheld]) or Netflix. All harvested Netflix user data is POSTed to this domain. The MH=10800000 field (3 hours) sets the recurring scrape interval, confirming this is a persistent, covert exfiltration loop.
- Critical
Credential Theft
The extension extracts the Netflix session authURL (an authentication credential used to sign internal API requests) from the page's in-memory context and embeds it in every API call. This credential, along with the user's GUID and profile GUID, is subsequently attached to the data payload POSTed to [domain withheld] — constituting direct credential theft rather than mere data collection.
- Critical
Unauthorized Data Collection
A complete C2 framework: the extension contacts [domain withheld] to receive a session ID and a list of commands, then executes each command against Netflix's internal API (profiles, viewing history, ratings, device history) and POSTs the results to [domain withheld]}. Viewing and rating commands loop via 'get_next' responses until the server says to stop, enabling full historical data extraction for every profile on the account. This is a server-directed data exfiltration botnet, not a Netflix category browser.
- Critical
Unauthorized Data Collection
When in-memory context is insufficient, the extension fetches the full HTML of [domain withheld] and parses the embedded React context from the page source. The account page contains billing details, payment method identifiers, subscription information, and personal account settings — far beyond what a hidden-category browser would ever need.
- Medium
Other
The bundled declares no permissions at all, while the live CWS manifest summary shows 'storage' as a declared permission. The also references ' ' which is absent from the bundle, suggesting the popup UI is non-functional — the extension's sole real purpose is the covert [domain withheld] content script.
Analyst notes
The extension contains a fully-implemented command-and-control data-harvesting engine (NetflixV2Hunter) that injects into [domain withheld], scrapes Netflix user profiles, viewing history, rating history, device history, and authentication tokens (), then exfiltrates all of it via POST to a third-party C2 server at [domain withheld] — a domain completely unrelated to the publisher's declared domains ([domain withheld]). The C2 server issues commands (get_p, get_v, get_r, get_d) and the extension obediently executes them and returns paginated data; the run loop repeats every 3 hours (MH=10800000ms). The third-party risk score flags content-script injection and chrome-stats rates it low-likelihood partly due to good rating, but the code leaves no ambiguity; the ML medium score (0.32) substantially undersells the threat.
![FindFlix : see Netflix hidden categories [QVI]](https://img.extensionauditor.com/image/https://lh3.googleusercontent.com/V8etcwY8JQ61tzXM3uXnOj0GnujFueE2x1PPIHzNmlyJi0SLNOd7g1h1Rq7qZx9-bDeRVySeJAh83nfQsgXNgvrQH8Q=s0?width=256)
FindFlix : see Netflix hidden categories [QVI] Chrome extension security report
ID: mlcghhoipahfflceodiejjljgbolbldo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Streaming Extensions
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 1021 East Lincolnway Cheyenne, WY 82001 US
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
22 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Extension enables access to all hidden categories on Netflix.
Read the publisher’s full description
Are you tired of the fixed list of the same few categories Netflix’s trying to impose on you? Did you know that there are thousands of hidden categories that you can explore? (and I bet you haven’t heard of the majority of them before). All you need to do is add Findflix extension to your browser and you're ready to explore all the secret categories that are hidden by default. It's as simple as that! This extension is part of the Quality Viewership Initiative, a collaborative effort to enhance the understanding of audience engagement. It collects anonymous, aggregated viewing insights to support creators and studios in improving the quality of their content. You can stop sharing your information at any time by switching the toggle on the options page. Disclaimer : Netflix is a trademark of Netflix, Inc.. This website & extension hold no association or affiliation with Netflix or any third-party companies.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
22 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from Streaming Extensions
- Prime Party [QVI]60,000 users
- UltraWide Streaming: custom ratios [QVI]30,000 users
- Netflix - higher quality [QVI]20,000 users
- Multi Skipper: Skip ads, intros & recaps [QVI]10,000 users
- Tubi Ad Skipper | Ad Blocker [QVI]10,000 users
Popular in Just for Fun
- Custom Cursor for Chrome™6,000,000 users
- Return YouTube Dislike5,000,000 users
- Stylish - Custom themes for any website2,000,000 users
- My Doodle1,000,000 users
- Shimeji Browser Extension1,000,000 users