Medium risk browser extensions

Kami removes a cross-origin security header from Google Classroom pages to enable its document integration.

PrinterLogic Extension bridges web pages to a local native print client on every site, relaying commands without validating the message origin.

Code analysis indicates Teleparty scrapes your complete Netflix viewing history and sends it to its own servers.

Microsoft Bing Search for Chrome fetches remote HTML templates from a Microsoft-controlled URL and injects them into every HTTPS page visited.

QuillBot sends behavioral telemetry including the URLs of pages where it is active to its own Snowplow collector.

DeepL attaches a persistent installation ID and browser fingerprint to every analytics event it sends to its servers.

Secure Exam Proctor conceals all server domain names and API paths inside integer byte arrays throughout its code.

Поиск Яндекса transmits a persistent UUID, browser brand, OS, and extension version to Yandex analytics every 15 minutes.

Content Server Browser Web Extension exposes two unscoped bridges that allow any webpage to invoke OpenText native desktop applications.

Free Download Manager accepts remote uninstall commands from freedownloadmanager.org pages, allowing any such page to remove the extension.

This extension shows Microsoft Rewards progress and provides quick access to reward activities and redemption pages.

PDF-XChange relays unvalidated postMessage URLs from any page script to a native host application on the user's computer.

Signer.Digital exposes a postMessage bridge on every page that any website can use to relay commands to a local native PKI host.

LanguageTool sends detailed usage telemetry to its analytics servers, including a persistent unique user ID and subscription and trial status.

Language Reactor sends YouTube and Netflix viewing metadata and subtitle transcripts to api.dioco.io on every page load.

AHA Music sends your Google email, a persistent device ID, and active tab URL to extension.doreso.com on every popup open.

ActivID CMS extension exposes a native messaging bridge to any HTTPS page that dispatches a custom DOM event.

Installs local .crx extension files with a permission review before installation.

VPNLY collects users' real IP and location, sends them to an undisclosed domain, and fetches a Telegraph page over HTTP on every proxy connection.

Free VPN For Chrome - Planet VPN resolves its backend API URL from a Telegraph dead-drop page on every startup, allowing the operator to silently redirect all traffic.

Adds real-time camera effects and background changes for Google Meet calls.

Keywords Everywhere exposes the user's API key to any website via a postMessage handler with no origin check.

MEDITECH Extended Software and Hardware bridges MEDITECH web pages to a local native application via a title-gated content script relay.

Mobile simulator - responsive testing tool sends paid subscribers' email and account identifiers to PostHog analytics, bypassing the analytics opt-out setting.

MultiPassword broadcasts vault credentials to any page via wildcard postMessage and exposes its vault API to multipassword.com subdomains.

Redux DevTools exposes full Redux application state and action dispatch to any other installed Chrome extension.

Scopus Document Download Manager accepts custom events from any webpage to trigger PDF downloads via the browser's download API.

Solventum Fluency Direct Web Connector exposes an unguarded CustomEvent bridge that lets any web page send commands to the locally-installed native host or overwrite extension storage.

Topaz SigPlusExtLite exposes a biometric signature-pad bridge to every website with no origin restriction.