High risk browser extensions

FC 26 Coins Generator FUT captures your EA Ultimate Team session token and sends it to api.futfun.com.

FancyGPT sends saved ChatGPT conversation text to its Firebase Storage bucket when its chat editor opens.

Find WhatsApp Link reads your WhatsApp account number and sends it to Aliyun Logs.

Google Meet AI Translate reads the active Meet page for your account email and sends it to 5.44.46.205 over HTTP.

Hudu Assist records password-field keystrokes during Process Capture and can send saved steps to Hudu.

IMDb Ratings for Netflix removes Netflix page protections and injects JavaScript from lcdn.srvcdn.net.

Image Search injects every site and sends referrer data and Ethereum-provider presence to Mixpanel.

Immersive Reader - Improve Reading Accessibility sends login details and selected page text to Amplitude analytics.

Nome de Atendente para WhatsApp sends your WhatsApp account identifier to tbbc.app analytics from WhatsApp Web.

Proxy Switcher can route Chrome traffic through a hardcoded proxy when its Test Proxy button is clicked.

QSafe wallet sends a SHA-256 hash of the wallet mnemonic to QSafe's daily-login endpoint after unlock.

Search & Chat AI injects server-supplied JavaScript into matched pages and accepts remote request-rule updates.

Search for Perplexity ai sends every keystroke typed in the address bar to perplexity-ai.online, a domain unaffiliated with Perplexity AI.

Translator fetches remote feature settings that can add configured elements to matching webpages.

UltraBlock sends each visited page URL and a persistent device ID to api.ultrablock.org as tabs finish loading.

WA Self Sender & Easy Sender sends WhatsApp message bodies and recipient phone numbers to Aliyun Logs.

Wavenet for Chrome sends selected text and the user's Google Text-to-Speech API key to Sentry after failed speech requests.

Work.ink Pass redirects most visited pages through pass.work.ink with the page URL and extension fingerprint.

VPN for Telegram loads remote proxy settings that can replace its PAC script for all browser destinations.

Ask Gene sends very large page text to its embedding backend when eligible pages become active.

Kinopoisk Player injects Yandex Metrica's Webvisor session-replay tracker into every website you visit, not just kinopoisk.ru.

NOKA FUT EA FC 26 fetches HTTP JavaScript from 35.180.119.144 and executes it inside EA WebApp pages.

Roam Highlighter sends copied bookmarks and highlighted page text, including page URLs and titles, to PostHog analytics.

ZeeDrop runs shopping-site scripts fetched from www.zeedroptool.com when matching store pages load.

Send Mass Mail + HTML inserter for Gmail sends visible page text to gpt.ga when its AI assistant generates answers.

Special Characters records extension UI sessions and sends replay events to tglens.tabgraf.com.

Suno AI Music Generator sends its login passport token to Alibaba ARMS telemetry during sign-in.

UFABC next sends university session cookies and page tokens to api.v2.ufabcnext.com.

Dog Cuties sends new-tab search queries to dogcuties.com before showing results.

Easy Package Tracker reports the URL and title of every page you visit to its own server, tagged with a persistent install ID.

Easync Product ID Grab Tool for Drop Shipping deletes saved Amazon and Walmart addresses when its grabber runs on address pages.

Fanpage likes stores Facebook page access tokens and exposes them to its helper site.

The extension sends TEFAS portfolio and fund activity events to Google Analytics.

WhenX sends note text, labels, tags, related URLs, and Google search queries to Mixpanel analytics.