High risk browser extensions

Blocks popups, pop-unders, and overlays while you browse the web.

Sprint YouTube Speed Up routes YouTube and Google video traffic through proxy servers it fetches from speedyext.ru.

Color Picker reports the full URL and referrer of every page you visit to gopickcolors.com, keyed to a persistent ID.

PriceBlink runs retailer configuration from tb.priceblink.com as page-context JavaScript during coupon autofill.

Ad Blocker Pro Shield assigns each installation a persistent identifier and sends it to its servers hourly, which can also push new blocking rules and DOM-manipulation scripts to the browser.

Sparkles Giveaway injects a button on YouTube that encrypts Steam trade offer credentials with a hardcoded operator-held RSA key, and fetches remote configuration via a covert DNS-over-HTTPS channel.

Color by Fardos sends all link URLs from every HTTPS page to admitad.com and replaces them with affiliate tracking links.

Perceptron Network reads Twitter OAuth2 session credentials from storage and sends them, along with full page DOM content, to its backend servers.

Smart Audio Capture transmits the URL of every page you visit, along with the previous URL, to its own compliance server.

VibeMate stays dormant until you open a livestream cam site, then reads the page's traffic and forwards chat and tip data to its servers.

AliExpress Search by Image sends every visited hostname and full page URL to searchbyimage.pro and can redirect users based on server instructions.

Orbital Daggers injects server-controlled HTML into its popup from fn.onionfist.com and exposes extension storage to onionfist.com pages.

USPS Tracking replaces the browser's default search engine with trackingnumbers.org, routing all omnibox searches and partial keystrokes to a third-party operator.

View Maps & Directions replaces the default search engine with viewmapsdirections.com, routing all browser searches and autocomplete requests through its server.

View Package Tracking sets viewpackagetracking.com as your default search engine and sends every omnibox query and keystroke there.

Earth replaces your default search engine, routing every address-bar query and keystroke to earthapp.net.