High risk browser extensions

Telegram Multi-account sends Telegram Web session storage to api.cloudapi.stream over WebSocket.

Video to MP3 uploads user-selected converted audio for AI transcription.

firestore export in one-click sends sample Firestore export data and Firebase context to Mixpanel during exports.

quicksnap reports visited URLs and a persistent fingerprint to pass.work.ink before server-directed redirects.

tuBee automates YouTube likes, subscriptions, comments, and watch-status reporting through cityhire.net.

Google Reader sends captured Google TTS tokens and page or selected text to an Appspot proxy for speech synthesis.

Video Downloader reads every browser cookie on load and sends the cookie data to data.x365.help.

AI Search Assistant for Google & Email Writer displays a remote iframe overlay when wallet-related page controls are clicked.

Arizona Helper by Sakai sends saved VK tokens and Discord webhook URLs to a complaint-transfer proxy.

ChatGPT Search Connect sends ChatGPT prompts and assistant answers to Amplitude analytics.

Chegg Expert - Every tool you need(Safest) sends Chegg session cookies to mrvishal.com on install and once a day.

DeepSeek Exporter sends selected DeepSeek chat content to analytics and its PDF rendering service during export.

Friend Disconnector sends Facebook friend profiles and activity metrics to api.frienddisconnector.com.

Image Translator - Manga Translator sends image URLs with site cookies and stored bearer tokens to translateimage.app.

IndiaMART Lead Manager sends completed buyer lead exports to scrappertool.com.

KYC Helper reads exchange verification tokens and sends them to api.sumsubio.com to create Telegram bot links.

Local Media Player sends consent-gated browsing URLs, headers, page titles, and referrers to its safe-browsing servers.

Logie Extension sends extracted Amazon product and search-page data to api.logie.ai.

MailProtect sends opened Gmail message details to app.mailprotect.ai when it detects tracking pixels.

Novalya extracts a Facebook OAuth access token, fetches friend profile details, and uploads them to api-v2.novalya.com.

Pocket-BOT sends PocketOption profile details and account balance to ai-tradebot.com on page load.

PoshPop | Poshmark Closet Bot can forward Poshmark cookies and request headers to poshpoptools.com in error logs.

Prompt Generator lets vocabulary.live read active-tab DOM, localStorage, tab metadata, selected text, and screenshots.

Publisher Discovery Extension sends visited page URLs, account email, clicks, and non-password form values to its servers.

Purrfect Pomodoro Timer sends daily journal entries and blocked-site URLs to PostHog analytics.

RoboApply sends application-form error reports with applicant details and screenshots to Discord webhooks.

SRM Academia Course Feedback Filler sends scraped student identity to a Supabase feedback log after filling feedback forms.

Skipply downloads rules from skipply.net that can inject JavaScript into matching tabs.

Uninquizitive modifies Norton InQuizitive pages to change scoring state and suppress anti-automation checks.

VirusScanner reports every URL you visit and every file you download to third-party servers, tagged with a persistent tracking ID.

WA - Send Message without saving contact writes WhatsApp message details and the active tab URL to Firebase.

OfficeWork sends the URL of nearly every page you visit to a third-party server and can be told to redirect your tab.

SavvyConnect streams every page you visit, plus raw request/response headers including cookies, to Luth Research.

HTML editor WebStudio for Webpages sends the URL of every site you visit to a tracking server on each tab switch.

Lighthouse routes all of your browser's traffic through a hardcoded third-party proxy server via an unlabeled icon on every new tab.

World to PDF Conversion injects code into every page you visit and runs JavaScript sent back by a lookalike domain.