High risk browser extensions

Pro Sender transmits your WhatsApp phone number and Google account email to its vendor backend on every WhatsApp Web visit.

Search by ViewPDF sets hviewpdf.com as the default search engine and sends ad-tracking data from browsing history to viewpdf.com on install.

Track24.ru fetches and executes remote JavaScript from api.track24.ru on AliExpress order pages without any integrity check.

Twitch Enhanced Viewer appends Twitch auth tokens and device IDs to media proxy URLs by default.

Video Downloader Chrome contacts loaderchrome.com on install and stores server-supplied config that controls extension behavior at runtime.

Video Downloader VeeVee loads a remote config whose switches can enable in-page code execution and domain-visit reporting on all sites.

Stylish transmits your full browsing history, link clicks, and Google search results to userstylesapi.com on every page navigation.

Amazon Quick View by AMZScout accepts backend tasks to fetch Amazon product pages and return parsed page data to AMZScout.

Autofill Smartly - JobFill sends full page text, form field metadata, and visited hostnames to jobfill.ai on user actions.

City Scapes sets your browser's default search engine to landscape-extensions.com, an unbranded third-party search proxy.

Email Signature Generator reads the email of every Google account signed in to Gmail and sends the list to cloudHQ.

Email Tracker by cloudHQ reads Gmail account addresses and sends tracked email metadata and rewritten links to cloudHQ.

GFormTasker redirects Google Forms submissions to gformtasker.xyz with answers and form metadata.

Gmail Polls & Surveys by cloudHQ reads your other signed-in Google account addresses and sends them to cloudHQ.

JoomPulse forwards intercepted Shopee marketplace API responses to joompulse.com.

Label Sharing for Gmail lists every signed-in Google account email and sends the list to cloudHQ on Gmail load.

Mask Network encrypts Twitter/X session cookies with a weak 6-digit key and uploads them to firefly.social.

Mobile Text Alerts for Gmail reads every signed-in Google account address and sends the list to cloudHQ.

Netflix Dual subtitle for learning languages loads Netflix page code from Google Cloud Storage when a remote manifest enables it.

OpenOffice Calc online sends every HTTP/HTTPS page URL you visit to offidocs.com with a persistent ID.

ProBoost can stream page network, cookie, storage, console, and recording data to pagespy.microdata-inc.com after a gesture.

SEO-анализ сайта от Be1.ru fetches server-selected URLs and sends response content and headers to w.be1.ru.

Sixpence captures every page's network traffic and, on server command, silently scrapes hidden tabs and LinkedIn data to its own backend.

Video download assistant injects a PAC proxy to route Chrome's extension update traffic through a hardcoded third-party server.

WABiz Bulk Sender transmits message content, recipient phone numbers, and Google account credentials to its vendor servers on every use.

YouTube AdBlock - Coffee Break for YouTube transmits full browsing history and browser fingerprint to its developer analytics server on every page navigation.

Lock Adblock injects a hidden iframe pointing to loader.media into every page visited, starting four hours after installation.