High risk browser extensions

Video download assistant injects a PAC proxy to route Chrome's extension update traffic through a hardcoded third-party server.

YouTube AdBlock - Coffee Break for YouTube transmits full browsing history and browser fingerprint to its developer analytics server on every page navigation.

Lock Adblock injects a hidden iframe pointing to loader.media into every page visited, starting four hours after installation.

AI Image of the Day sends each loaded HTTP(S) tab URL to Takeads and redirects tabs to returned tracking links.

APP For IG DM sends Instagram CSRF tokens and inbox API responses to Alibaba Cloud logs during auto-reply monitoring.

Browse.live Web Safety can scrape configured page text or attributes and send them with page URLs to Browse.live.

CaptchaSonic uploads your installed-extension inventory and stable browser fingerprint after API-key setup.

Car Tab sends the hostnames of frequently visited sites to Google's favicon service when the new tab opens.

Coin Search reports each visited page URL and hostname to coinsearch.cash when rewards are enabled.

Disney Plus Subtitle Translator - Dual Subtitles sends subtitle text, page context, and runtime/storage events to Amplitude.

DivMagic forwards selected page DOM content and page URLs to api.divmagic.com when export or save actions run.

Double sends authenticated Xero page content and Xero cookies to prod.keeper.app.

FC 26 Coins Generator FUT captures your EA Ultimate Team session token and sends it to api.futfun.com.

FancyGPT sends saved ChatGPT conversation text to its Firebase Storage bucket when its chat editor opens.

Find WhatsApp Link reads your WhatsApp account number and sends it to Aliyun Logs.

Google Meet AI Translate reads the active Meet page for your account email and sends it to 5.44.46.205 over HTTP.

IMDb Ratings for Netflix removes Netflix page protections and injects JavaScript from lcdn.srvcdn.net.

Image Search injects every site and sends referrer data and Ethereum-provider presence to Mixpanel.

Immersive Reader - Improve Reading Accessibility sends login details and selected page text to Amplitude analytics.

Nome de Atendente para WhatsApp sends your WhatsApp account identifier to tbbc.app analytics from WhatsApp Web.

OZONBIGSELL modifies Ozon seller analytics pages to return Premium Plus access and synthetic analytics data.

Proxy Switcher can route Chrome traffic through a hardcoded proxy when its Test Proxy button is clicked.

QSafe wallet sends a SHA-256 hash of the wallet mnemonic to QSafe's daily-login endpoint after unlock.

Search for Perplexity ai sends every keystroke typed in the address bar to perplexity-ai.online, a domain unaffiliated with Perplexity AI.

TecWorld Descontos sends checkout-page URLs and selected page values to descontos.tecworld.com.br.

Translator fetches remote feature settings that can add configured elements to matching webpages.

UltraBlock sends each visited page URL and a persistent device ID to api.ultrablock.org as tabs finish loading.

WA Self Sender & Easy Sender sends WhatsApp message bodies and recipient phone numbers to Aliyun Logs.

Work.ink Pass redirects most visited pages through pass.work.ink with the page URL and extension fingerprint.

VPN for Telegram loads remote proxy settings that can replace its PAC script for all browser destinations.

Black Friday de Verdade sends matched checkout-page URLs and extracted page values to its backend.

Economize! Mundo Conectado extracts shopping-page values and sends them to its vendor backend.

Ask Gene sends very large page text to its embedding backend when eligible pages become active.

NOKA FUT EA FC 26 fetches HTTP JavaScript from 35.180.119.144 and executes it inside EA WebApp pages.

Roam Highlighter sends copied bookmarks and highlighted page text, including page URLs and titles, to PostHog analytics.

ZeeDrop runs shopping-site scripts fetched from www.zeedroptool.com when matching store pages load.