Medium risk browser extensions

Kami removes a cross-origin security header from Google Classroom pages to enable its document integration.

PrinterLogic Extension bridges web pages to a local native print client on every site, relaying commands without validating the message origin.

Microsoft Bing Search for Chrome fetches remote HTML templates from a Microsoft-controlled URL and injects them into every HTTPS page visited.

QuillBot sends behavioral telemetry including the URLs of pages where it is active to its own Snowplow collector.

DeepL attaches a persistent installation ID and browser fingerprint to every analytics event it sends to its servers.

Secure Exam Proctor conceals all server domain names and API paths inside integer byte arrays throughout its code.

Stands AdBlocker transmits every page URL and referrer to standsapp.org on each navigation, linked to a persistent user ID.

Content Server Browser Web Extension exposes two unscoped bridges that allow any webpage to invoke OpenText native desktop applications.

Free Download Manager accepts remote uninstall commands from freedownloadmanager.org pages, allowing any such page to remove the extension.

This extension shows Microsoft Rewards progress and provides quick access to reward activities and redemption pages.

PDF-XChange relays unvalidated postMessage URLs from any page script to a native host application on the user's computer.

Signer.Digital exposes a postMessage bridge on every page that any website can use to relay commands to a local native PKI host.

Поиск Яндекса transmits a persistent UUID, browser brand, OS, and extension version to Yandex analytics every 15 minutes.

Language Reactor sends YouTube and Netflix viewing metadata and subtitle transcripts to api.dioco.io on every page load.

AHA Music sends your Google email, a persistent device ID, and active tab URL to extension.doreso.com on every popup open.

ActivID CMS extension exposes a native messaging bridge to any HTTPS page that dispatches a custom DOM event.

EPUBReader exposes a reader page that any website can load to send HTTP requests to arbitrary URLs, including internal network addresses.

VPNLY collects users' real IP and location, sends them to an undisclosed domain, and fetches a Telegraph page over HTTP on every proxy connection.

Free VPN For Chrome - Planet VPN resolves its backend API URL from a Telegraph dead-drop page on every startup, allowing the operator to silently redirect all traffic.

MEDITECH Extended Software and Hardware bridges MEDITECH web pages to a local native application via a title-gated content script relay.

Mobile simulator - responsive testing tool sends paid subscribers' email and account identifiers to PostHog analytics, bypassing the analytics opt-out setting.

MultiPassword broadcasts vault credentials to any page via wildcard postMessage and exposes its vault API to multipassword.com subdomains.

Scopus Document Download Manager accepts custom events from any webpage to trigger PDF downloads via the browser's download API.

Solventum Fluency Direct Web Connector exposes an unguarded CustomEvent bridge that lets any web page send commands to the locally-installed native host or overwrite extension storage.

Topaz SigPlusExtLite exposes a biometric signature-pad bridge to every website with no origin restriction.

Wordtune captures the full HTML content of AI chatbot pages and transmits it to its own servers.

uBlock sends daily encrypted per-domain telemetry to eyeo's servers and a persistent-UUID ping to ublock.org with OS and browser details.

Search and download free Android app APK or XAPK files from APKPure.

Adds real-time camera effects and background changes for Google Meet calls.

CocoCut captures Cookie and Authorization headers from all HTTP requests and stores them in extension session storage.

This extension connects websites to the ЦСК user signature web library.

Enhances YouTube watching with AutoHD, cinema mode, playback controls, and visual customization.

Hunter sends the domain of every website you visit to extension-api.hunter.io on each tab change and navigation.

SingleFile saves web pages as single HTML files and injects content scripts on all URLs that accept unvalidated postMessage events, enabling cross-origin DOM capture.

Stacker - Falling tetra blocks! fetches ad content from a remote server and injects it as raw HTML into the extension popup, and opens background tabs on install and update.

Enhancer for YouTube exposes its preference object, including custom script and CSS text, to YouTube page scripts.

Bitly | Short links and QR Codes ships a hardcoded OAuth client_secret in its extension bundle.

Focus To-Do ships hardcoded STOMP broker credentials in its bundle, connecting all users to a shared message queue at mq.focustodo.net.

Lightning Autofill fetches encrypted JavaScript from its servers and injects it into every web page for paid license holders.

Turns web searches and new tabs into support for ocean plastic cleanup projects.

Todoist for Chrome exposes its popup page to all websites and accepts navigation commands without verifying the sender's origin.

BetterTTV stores its OAuth access and refresh tokens in Twitch page localStorage.

Microsoft Bing Search Engine reads all browser cookies to find tracking codes and sends browser telemetry to g.ceipmsn.com daily.

Music Search for Chrome™ overrides the browser's default search engine and routes all search queries to amazingossearch.com with an affiliate tracking parameter.

NCapture sends a persistent per-installation UUID to its vendor server on every OAuth credential request and uses a hardcoded AES key to decrypt those credentials client-side.

Netflix Party matches every site you visit against server-supplied rules and fires background requests to whatever URLs its backend returns.

Netmirror Extension silently injects a Referer header pointing to fmoviesunblocked.net for any request containing a covert URL token.