High risk browser extensions

Chegg Expert - Every tool you need(Safest) sends Chegg session cookies to mrvishal.com on install and once a day.

DeepSeek Exporter sends selected DeepSeek chat content to analytics and its PDF rendering service during export.

Distill shares LinkedIn session cookies and profile page HTML with Distill services.

Friend Disconnector sends Facebook friend profiles and activity metrics to api.frienddisconnector.com.

Image Translator - Manga Translator sends image URLs with site cookies and stored bearer tokens to translateimage.app.

IndiaMART Lead Manager sends completed buyer lead exports to scrappertool.com.

Local Media Player sends consent-gated browsing URLs, headers, page titles, and referrers to its safe-browsing servers.

Logie Extension sends extracted Amazon product and search-page data to api.logie.ai.

MailProtect sends opened Gmail message details to app.mailprotect.ai when it detects tracking pixels.

Novalya extracts a Facebook OAuth access token, fetches friend profile details, and uploads them to api-v2.novalya.com.

Pocket-BOT sends PocketOption profile details and account balance to ai-tradebot.com on page load.

PoshPop | Poshmark Closet Bot can forward Poshmark cookies and request headers to poshpoptools.com in error logs.

Prompt Generator lets vocabulary.live read active-tab DOM, localStorage, tab metadata, selected text, and screenshots.

Publisher Discovery Extension sends visited page URLs, account email, clicks, and non-password form values to its servers.

Purrfect Pomodoro Timer sends daily journal entries and blocked-site URLs to PostHog analytics.

PvU Legacy Tool sends the Plant vs Undead marketplace auth token to temp.doihoatien.com.

RoboApply sends application-form error reports with applicant details and screenshots to Discord webhooks.

Skipply downloads rules from skipply.net that can inject JavaScript into matching tabs.

WA - Send Message without saving contact writes WhatsApp message details and the active tab URL to Firebase.

eimmigration e-Filer fetches backend-supplied JavaScript and runs it in the active tab.

GoStream - Facebook LIVE copies every Facebook cookie, including the session token, into a clipboard-ready block with one click.

KYC Helper reads exchange verification tokens and sends them to api.sumsubio.com to create Telegram bot links.

Undetectable Adblocker Alt sends the full URL of every page you visit to its own server, along with a persistent device ID.

Antidrain Wallet blocks rival wallet extensions and swaps its own provider into their place so dApps unknowingly connect through it.

Clean Adblocker reports every site you visit to its own server and reframes Google/Amazon search pages to scrape and upload the results.

DAMI fetches unsigned JavaScript from its own CDN and injects it into the seller's authenticated TikTok Shop tab.

Parcel Journey Updater executes JavaScript sent back by its own server inside live Amazon account pages on every automatic update.

Gimme Video reads your full site cookie jar on YouTube, Instagram, Facebook, Reddit, X/Twitter or TikTok and sends it to its own server.

REAL BOOSTER - YouTube fetches remote 'missions' and auto-searches, watches, likes, and subscribes on YouTube on the user's behalf.

NerdyData Website Inspector lets its own server issue arbitrary authenticated LinkedIn API requests through the user's browser session.

Lighthouse routes all of your browser's traffic through a hardcoded third-party proxy server via an unlabeled icon on every new tab.

AliBaba Search by Image | Rovalty sends every page you visit, plus a persistent device ID, to a third-party server on each load.

Extrator de token • Ace Bot captures the user's Discord session token and displays it for hand-off to the third-party "Ace Bots" service.

World to PDF Conversion injects code into every page you visit and runs JavaScript sent back by a lookalike domain.