Critical risk browser extensions

Urban VPN captures keystrokes, checkout PII, and browsing activity from 133 ecommerce sites and transmits them to falais.com servers.

Poper Blocker sends browsing data (URL, referrer, clicked links) to its own servers and pulls remote scraping rules that drive DOM data extraction.

Stylish fetches targeting rules from its own servers and routes encrypted browsing data to them on every page visit.

Blocks ads, pop-ups, video interruptions, and trackers while updating filtering rules from cloud servers.

Downloads detected video files and HLS streams from webpages to your computer for offline playback.

Popup Blocker fetches per-domain JavaScript from popupsblocker.org and runs it in the main page context of any site you visit.

GMPlus reads users' ChatGPT session token from chat.openai.com and uses it to submit their prompts to OpenAI's backend on their behalf.

The extension intercepts social media API responses and transmits account profiles and session cookies to api.socialext.com.

North Ad-Block transmits open-tab domains to its server on install and allows that server to push arbitrary JavaScript into every browsed page.

Easy Quiz Poly captures login credentials and session cookies from supported school sites and sends them to api.quizpoly.xyz.

Kolr - AI Influencer Analytics Tool encrypts and uploads social-platform cookies to Kolr's lookup API.

Language Reactor transformed captures a ChatGPT bearer token and sends it to appforlanguage.com during AI prompt generation.

Dark Reader for Chrome sends update data to dark-reader.com and applies server-provided programs in its service worker.

NeoCloud Plug lets gitea.neobay.co.kr command cookie, page HTML, and fetch requests across arbitrary websites.

The extension stores VULMS login credentials and sends them with student profile data to a Google Apps Script endpoint.

Panda Video collects YouTube and Google session cookies and sends them to its import service during YouTube imports.

Photoshop Online runs JavaScript fetched from googlle.click in the active tab after pages finish loading.

Rologin sends Roblox usernames and passwords in encoded status URLs to rologin.link.