High risk browser extensions

Clean Adblocker reports every site you visit to its own server and reframes Google/Amazon search pages to scrape and upload the results.

Parcel Journey Updater executes JavaScript sent back by its own server inside live Amazon account pages on every automatic update.

iFoxTab records the origin and first two path segments of pages you visit and uploads them to flolight.cn.

AliCoupons fetches remote HTML from api.ceresin.xyz and writes it into pages you visit on any website.

Gimme Video reads your full site cookie jar on YouTube, Instagram, Facebook, Reddit, X/Twitter or TikTok and sends it to its own server.

Image Downloader Professional Premium sends the full URL of every web page you open to runapps.org.

REAL BOOSTER - YouTube fetches remote 'missions' and auto-searches, watches, likes, and subscribes on YouTube on the user's behalf.

NerdyData Website Inspector lets its own server issue arbitrary authenticated LinkedIn API requests through the user's browser session.

Lighthouse routes all of your browser's traffic through a hardcoded third-party proxy server via an unlabeled icon on every new tab.

AliBaba Search by Image | Rovalty sends every page you visit, plus a persistent device ID, to a third-party server on each load.

Media Downloader for X sends your full x.com cookie set, including login tokens, to api.x-downloader.com.

postAPI sends every API test request, including custom headers and auth tokens, through a relay server at 49.235.118.199 over plain HTTP.

Extrator de token • Ace Bot captures the user's Discord session token and displays it for hand-off to the third-party "Ace Bots" service.

GoGPT monitors every page you visit and can silently redirect your active tab based on a remote command.

AliGuard polls api.sciethy.com for instructions that can redirect your tabs or replace page content with remote HTML.

World to PDF Conversion injects code into every page you visit and runs JavaScript sent back by a lookalike domain.

Alitools Shopping Assistant sends every page URL you load to a remote server and runs the code it replies with.

Cherry Pick sends the text of checkout pages, your email and saved cards to its Supabase backend.