Browser extensions starting with C

click to call requests your public IP address to create a persistent uniqueId for its service.

Catena Wallet derives its vault encryption key with only 10,000 PBKDF2 iterations, well below modern guidance.

CIVR Connector accepts postMessage from any web page and uses it to auto-fill and submit DICOM viewer login credentials.

Coles Trend sends viewed Coles product metadata and store selection data to its API.

CofilmAI Chrome Extension sends the current YouTube video URL and caption-track URL to Cofilm's summary API.

Cookies Helper exports all of your browser's cookies to a file, or to a paired desktop app, on request.

COGext : System Monitor resolves your public IP address through api.ipify.org for its network dashboard.

This extension blocks suspicious patterns copied through the browser to help defend against phishing.

CNFans Warm Remover rewrites scoped shopping product URLs to add affiliate referral codes.

cat-catch records media request URLs, page details, and selected headers for media it detects on visited pages.

CGI US Visa Appointment Auto Rescheduler stores your portal password and security answers in plaintext via Google Chrome Sync.

CAD Viewer accepts an auth token from any page on localhost, not just its own login page, and stores it as the user's session.

Cassou accepts a postMessage from any sender and writes its cookie field into the page's cookies without checking the message's origin.

CFCA CertEnrollment.JLBank Extension connects to a caller-chosen native messaging host and relays the caller's payload with no allowlist.

Clean Adblocker reports every site you visit to its own server and reframes Google/Amazon search pages to scrape and upload the results.

Ctool 程序开发常用工具 sends a beacon to its own server every time you open one of its dev tools, tagged with a persistent user ID.

Check US Visa Slots stores your visa-portal username, password, and security-question answers in plaintext.

Companion for Reddit renders operator-controlled messages from its own server as raw HTML, skipping sanitization on the first render.

Classi AI 학생 sends the student's browsing history, Gemini AI chat content, and live screen/camera to a teacher dashboard.

ChatGPT Assistant - GPT Search sends everything you type into Google, Bing and other search engines to a third-party server, not to ChatGPT.

CNN U.S. inserts news feed content from notifiernews.com into its popup using unescaped HTML.

CFCA CryptoKit.UnionPayIntl Extension bridges UnionPay banking pages to native signing/certificate applications on the user's computer.

CaptionGo forges Referer, Origin, and User-Agent headers to impersonate DeepL, Tencent, ByteDance, and Microsoft's own translation apps.

CFCA CryptoKit.XMYLSW Extension lets any xmztb.com page pick the native-messaging host and payload it forwards, with no allowlist.

Chatgpt Unblocked routes chatgpt.com and any site you add through fixed proxy servers using one hardcoded login shared by all installs.

Calculator Extension redirects visits to server-listed sites and rewrites clicked links through a remote-chosen URL.

Generates AI comment suggestions for LinkedIn posts based on the user’s profile, tone, and settings.

CaseSnappy Summarizer renders its AI-generated case summary and error messages into the popup via innerHTML without sanitizing them.

Cents Per Point Calculator ships an unused test file containing a hardcoded Hilton session token, but nothing in the extension loads it.

CFCA JJCCB V3 Extension bridges four Chinese bank sites to a local PKI native host, reachable over unencrypted http:// too.

Clyck List reads your LinkedIn session cookies and sends them to its own backend to replay your login.

CFCA CertEnrollment.CRBank Extension relays crbank.com.cn page requests to a native messaging host with no in-handler sender check.

Console Poly sends the class roster and attendance record to a Google Form and its own server on every attendance submission.

CFCA CertEnrollment relays messages from a narrow set of internal addresses to a local PKI app without validating the command.

CFCA CryptoKit relays a caller-named native messaging host and payload to it, with no allowlist check.

CFCA CryptoKit.TRTCW Extension relays native-messaging commands for any page matching one of four bare IP addresses, not a vendor domain.

CFCA CryptoKit connects to any native-messaging host that sinotrans.com or y2t.com pages name, with no host allowlist.

Citrix Secure Access (Canary) periodically sends browsing history and device/user telemetry to a Citrix-controlled endpoint.

Click to component listens for window messages with no origin check, letting any page script redirect its next clicked-source URL.

The extension lets any page on broaderway.com.cn tell it which native messaging host to connect to, instead of enforcing one fixed host.

ChatGPT Ad Blocker runs a content script on every website and applies hide/remove rules fetched from its own server every 6 hours.

CFCA CryptoKit.Paperless.tycw Extension relays messages between CFCA/Genertec banking pages and a local smart-card signing application.

CFCA CryptoKit.Paperless.WEGO Extension forwards page-supplied native host names and data to a local smart-card app without validation.

CFCA CryptoKit.NCWR Extension relays messages from any page on localhost or 127.0.0.1 to its installed native application, unfiltered.

CFCA CryptoKit.changecloud Extension bridges its own web pages to a locally installed native application over Chrome's native messaging API.

CFCA CertEnrollment relays native-messaging commands from CFCA's own changecloud domains with no further validation.

Custom Aurora Background requests your precise geolocation and sends the coordinates to OpenWeatherMap on every new tab.

CG No Login Master runs its popup script on every website visited, sending the page's origin and the user's IP to its vendor's server.

CPR Enroll Agency Connect runs server-supplied automation steps on certification tabs, some via OS-level synthesized clicks.

CG Entry Master sends the user's email, access token, and IP address to its server in cleartext HTTP, embedded in the request URL.

Canvas-Wise reads every question and answer option on a Canvas quiz page and sends them to its own server to auto-fill answers.

Class Timer sends the active tab's hostname and your typed timer title to its own server whenever you start a timer.

Clean for LinkedIn hands its own web app your LinkedIn session cookie on request.

Provides access to CK-12’s free math, science, and other learning content.

This extension provides an offline calculator with standard, memory, and scientific functions.

Create web and print designs with templates, fonts, images, and photo editing tools.