Medium risk browser extensions

Kami removes a cross-origin security header from Google Classroom pages to enable its document integration.

PrinterLogic Extension bridges web pages to a local native print client on every site, relaying commands without validating the message origin.

Loom sends analytics events including your Segment identity and loom.com cookies to api.segment.io.

Microsoft Bing Search for Chrome fetches remote HTML templates from a Microsoft-controlled URL and injects them into every HTTPS page visited.

QuillBot sends behavioral telemetry including the URLs of pages where it is active to its own Snowplow collector.

DeepL attaches a persistent installation ID and browser fingerprint to every analytics event it sends to its servers.

Hola VPN captures Chrome-internal identity headers from your Google requests and sends them to its servers every 10 minutes.

Поиск Яндекса transmits a persistent UUID, browser brand, OS, and extension version to Yandex analytics every 15 minutes.

Content Server Browser Web Extension exposes two unscoped bridges that allow any webpage to invoke OpenText native desktop applications.

Free Download Manager accepts remote uninstall commands from freedownloadmanager.org pages, allowing any such page to remove the extension.

This extension shows Microsoft Rewards progress and provides quick access to reward activities and redemption pages.

Signer.Digital exposes a postMessage bridge on every page that any website can use to relay commands to a local native PKI host.

LanguageTool sends detailed usage telemetry to its analytics servers, including a persistent unique user ID and subscription and trial status.

Free VPN For Chrome - Planet VPN resolves its backend API URL from a Telegraph dead-drop page on every startup, allowing the operator to silently redirect all traffic.

Language Reactor sends YouTube and Netflix viewing metadata and subtitle transcripts to api.dioco.io on every page load.

AHA Music sends your Google email, a persistent device ID, and active tab URL to extension.doreso.com on every popup open.

Search and download free Android app APK or XAPK files from APKPure.

ActivID CMS extension exposes a native messaging bridge to any HTTPS page that dispatches a custom DOM event.

Installs local .crx extension files with a permission review before installation.

VPNLY collects users' real IP and location, sends them to an undisclosed domain, and fetches a Telegraph page over HTTP on every proxy connection.

Adds real-time camera effects and background changes for Google Meet calls.

Keywords Everywhere exposes the user's API key to any website via a postMessage handler with no origin check.

MEDITECH Extended Software and Hardware bridges MEDITECH web pages to a local native application via a title-gated content script relay.

Mobile simulator - responsive testing tool sends paid subscribers' email and account identifiers to PostHog analytics, bypassing the analytics opt-out setting.

MultiPassword broadcasts vault credentials to any page via wildcard postMessage and exposes its vault API to multipassword.com subdomains.

Redux DevTools exposes full Redux application state and action dispatch to any other installed Chrome extension.

Scopus Document Download Manager accepts custom events from any webpage to trigger PDF downloads via the browser's download API.

Topaz SigPlusExtLite exposes a biometric signature-pad bridge to every website with no origin restriction.

This extension replaces the default Chrome pointer with customizable cursors for web browsing.