High risk browser extensions

Sprint YouTube Speed Up routes YouTube and Google video traffic through proxy servers it fetches from speedyext.ru.

Sparkles Giveaway injects a button on YouTube that encrypts Steam trade offer credentials with a hardcoded operator-held RSA key, and fetches remote configuration via a covert DNS-over-HTTPS channel.

Summary Webpage extracts the full article text of the active page and sends it to Hugging Face AI servers using hardcoded API tokens.

The extension reads your Twitch OAuth token and watch history, then transmits them to service.streamkey.ru over a persistent SignalR connection.

Ad Blocker Pro Shield assigns each installation a persistent identifier and sends it to its servers hourly, which can also push new blocking rules and DOM-manipulation scripts to the browser.

AI Chat Exporter sends the full text of exported Gemini conversations, plus your Google account name and email, to the vendor's servers.

Adblock for Browser sends each completed tab URL with a persistent user ID to abforbrowser.com.

Color by Fardos sends all link URLs from every HTTPS page to admitad.com and replaces them with affiliate tracking links.

Molly sends visited URLs and a device fingerprint to api.molly.gratis and injects the user's JWT token into pages on partner sites.

Salesforce Advanced Code Searcher sends Salesforce OAuth credentials and org source code to third-party GCP and Heroku servers.

Smart Audio Capture transmits the URL of every page you visit, along with the previous URL, to its own compliance server.

Urban Safe Browsing sends all-site navigation details and request/response metadata to Urban VPN safe-browsing servers.

VibeMate stays dormant until you open a livestream cam site, then reads the page's traffic and forwards chat and tip data to its servers.

AliExpress Search by Image sends every visited hostname and full page URL to searchbyimage.pro and can redirect users based on server instructions.

Amplitude Event Explorer intercepts all outgoing browser requests to extract analytics payloads and can activate full DOM session recording on any page.