Browser extensions starting with M

Mystique Search sets itself as the default search engine and routes all browser searches to mystiquestudio.net.

SEO Extension by Mangools sends the current tab URL to Google PageSpeed and Rollbar using hardcoded API keys embedded in the extension.

Scrolling Screenshot Full Page uploads screenshots to markuphero.com and accepts screenshot requests from markuphero.com pages.

Manga Translator sends a device fingerprint and base64-encoded image data to ichigoreader.com with every translation request.

MathWallet exposes the unlocked selected wallet account to HTTP and HTTPS pages where its provider is injected.

Looks up and translates Japanese words and selected sentences while you browse.

Write and save notes in Chrome with offline access and optional cloud sync.

Minea reads Facebook profile data (ID, name, city, birthday, gender) while browsing the Ads Library and sends it to data.minea.com.

Monosearch reads Amazon product and seller data from pages you view and forwards it to the vendor's mnsearch.com and mnrate.com backends.

This extension keeps MyRegistry gift recipient shipping details available during merchant checkout.

mail.com MailCheck scans open tab URLs at install to capture affiliate codes and sends account and install data to go.mail.com on uninstall.

Manuals Hunt and Search overrides the default search engine to Yahoo with undisclosed affiliate tracking parameters on every search.

Map Route Pro and Search relays search queries and inferred location to its servers and replaces your default search engine with Yahoo.

MP3 Downloader scans every webpage for audio file links and lets users download them directly from the popup.

MapQuest Directions transmits each search query in real time to its servers and injects server-controlled HTML into every new tab page.

Maps & Driving Directions fetches remote HTML from its own server and injects it into the new tab page without sanitization.

Mass Downloader for Instagram saves selected Instagram media and profile backups into organized ZIP downloads.

Measuremate sends license keys and email addresses over unencrypted HTTP to a bare IP address.

MergeMail reads Gmail compose content — body, subject, and all recipients — and sends it to mergemail.co before each email is sent.

Miden Wallet injects a wallet API into HTTPS pages and syncs state with the Miden testnet every 30 seconds.

Monosnap sends a periodic telemetry ping to its analytics server that includes the user's configured Amazon S3 base URL.

Multimedia Search overrides the default search engine to browsingsafety.net and sends all address-bar queries with an affiliate tracking ID.

Multiversity LockDown Browser transmits student name, username, and exam identifiers to a proctoring server and disables all other extensions during exam sessions.

My Focal Find sets itself as the default search engine and tags every search you type with a persistent per-install ID.

Myibidder Auction Bid Sniper for eBay sends the current eBay page URL to Myibidder when you click its added controls.

Mailvelope includes a hardcoded Google OAuth2 client_secret in its extension bundle, exposing the credential to anyone who unpacks the file.

Majestic Mountain Views sends every new-tab search query to landscape-extensions.com instead of your default search engine.

Economic Calendar, Market & News sends popup page-view analytics events to Google Analytics.

MONKNOW New Tab looks up your public IP address to infer your weather location.

Madomi - Manga Translator sends page text, image URLs, and image data to borang.skrin.xyz for translation and summarization.

Magic Copy sends the image you select from a page to Meta's Segment Anything prediction service.

Magnifying Glass for Google Chrome places a screenshot of the current tab into the page DOM after you click it.

Magoosh Vocabulary sends pronunciation lookup words and its embedded Wordnik API key to api.wordnik.com over HTTP.

Majestic Mountain Views sets an unbranded third-party site as your browser's default search engine and routes every search through it.

Mask Network encrypts Twitter/X session cookies with a weak 6-digit key and uploads them to firefly.social.

Matador.ai Extension lets Activix pages open Matador conversations with contact details supplied by the page.

Maven Tools for Salesforce reads Salesforce session cookies to call Salesforce APIs for its developer tools.

Mavryk Wallet replaces ads on all HTTPS pages with its own ads, using rules fetched from its servers.

Mayday lets any webpage with a spoofed trusted origin trigger ticket data to its recommendation API.

MeowLoad lets any web page ask it to open a supplied URL in a new browser tab.

Merkatys reads Wildberries search queries, product IDs, and auth tokens, and transmits them to its own servers.

Minea sends token data to data.minea.com with an embedded shared Basic Auth credential.

Mitel Connect exposes account and call state to allowed GapiAuth pages and lets them trigger calls.

Mobile View injects a responsive-design overlay into web pages and stores device-selection preferences locally via chrome.storage.sync.

Imports AliExpress products into Modalyst for dropshipping store management.

Modern for Wikipedia stores a local history of visited Wikipedia articles in browser storage.

Mouse Pinch-To-Zoom exposes its extension ID to pages while handling zoom behavior.

The extension sends X/Twitter page URLs, account email, settings, and persistent IDs to xcontentbackuptool endpoints.

m1pro sends Monopoly One page titles and URLs with a persistent client ID to Google Analytics.

Mate Translate sends daily translation statistics and account email to Gikken servers and transmits a persistent device ID at install time.

Media Converter and Muxer downloads FFmpeg from GitHub without verifying file integrity before installing it to the user's home directory.

MAL-Sync embeds hardcoded OAuth client secrets for three third-party services in its extension bundle.

My IP Hider VPN transmits user account passwords in plaintext in URL query strings and stores them unencrypted in local extension storage.

Mailtag records sent Gmail message metadata and plaintext email body to app.mailtag.io after sending.