Medium risk browser extensions

Companion Window sends the full URL of pages you visit plus a persistent user ID to GiveFreely's analytics server when its review prompt fires.

Create Link executes user-defined JavaScript in the content script context on every page visited when a custom format filter is set.

Crunchyroll Speeder reads your Crunchyroll account profile, watch history and subscriptions and uploads them to me3x.online.

Dashlinks - New Tab replaces the browser's new tab page and sends every search query to search4it.net along with the extension ID and version.

Debrid-Link renders notification details into every HTTP/HTTPS page where page scripts can read them.

Designer Daily Report exposes a postMessage handler that any webpage can use to open arbitrary tabs without origin validation.

Dice Thrower fetches a remote HTML snippet from cameronsamuels.com and injects it into the popup via innerHTML on every open.

Easy Web Data Scraper automatically collects Temu product data and forwards it to temuhunt.com during the user's browsing session.

Engage AI sends LinkedIn cookies and profile details to Engage AI backend endpoints.

Equicord Web loads QuickCSS editor code from cdn.jsdelivr.net while removing Discord content-security-policy headers.

Extension Club R reads the Rakuten auth cookie and sends the decoded member ID to Google Analytics on user interaction events.

FatCoupon Cashback & Promo Codes transmits the full URL of every page visited to its servers and fetches remotely-controlled code that executes in the context of web pages.

Footballguys Extension: Manage My Leagues sends fantasy-site cookies to Footballguys pages on request.

Force Paster sends paste activity, active hostnames, and field tags to a Cloud Functions analytics proxy.

Gmail Button by cloudHQ enumerates all signed-in Google accounts on Gmail load and sends collected email addresses to cloudhq.net.

Gmail Tabs by cloudHQ collects all signed-in Google account email addresses and transmits them to cloudhq.net on each Gmail load.

Google Pagespeed Insights ships hardcoded SMTP credentials and fetches remote-controlled HTML ads into its popup on every open.

Google Translate Assistant sends page URLs, device identifiers, and tab screenshots to its vendor servers during normal use.

HAVAH Wallet sends wallet interaction events (connect, sign, transaction URLs) to Google Analytics with a persistent client UUID.

HTML to PDF generates a device fingerprint on each popup open and transmits it with geolocation data to hub.malson.eu.

Howdou for Google Classroom sends the signed-in teacher's email address and assignment IDs to embed.howdou.net on every interaction.

IOTA Wallet sends detailed financial activity events — transactions, DApp connections, and key exports — to Amplitude's analytics servers.

Download multiple images from web pages with options to filter and save them in different formats.

Keeper Password Manager stores, autofills, and manages credentials across all websites and supports enterprise SSO authentication.

Klarway continuously captures screen video, webcam footage, and audio during exams and transmits them to its backend, while broadcasting session credentials to all page scripts.

Linguix sends text fragments surrounding grammar corrections to Amplitude analytics on any website.

MP3 Downloader scans every webpage for audio file links and lets users download them directly from the popup.

Magnifying Glass for Google Chrome places a screenshot of the current tab into the page DOM after you click it.

MapQuest Directions transmits each search query in real time to its servers and injects server-controlled HTML into every new tab page.

Maps & Driving Directions fetches remote HTML from its own server and injects it into the new tab page without sanitization.

Multiversity LockDown Browser transmits student name, username, and exam identifiers to a proctoring server and disables all other extensions during exam sessions.

Netflix Skipper collects Netflix account details, viewing history, and profile data and transmits them to remote servers on a 30-minute cycle.

OKIOCAM Live sets uploaded Google Drive files to public 'anyone with link' sharing without user confirmation.

OP_WALLET sends a persistent device ID and Bitcoin wallet address to its servers on every browser start.

Poshmark Bot Sharer by Flyp transmits Poshmark user IDs and API request URLs to Sentry's error-tracking servers.

Price Tracker 2.0 collects product data from 15+ e-commerce sites and transmits it, along with user agent and timezone, to api.indiadesire.com.

ProTab | Arbfonts injects script into competitor Arabic font sites to strip all hyperlinks, disabling navigation on those pages.

QuickSearch - חיפוש בטוח silently overrides the default search engine and homepage to redirect searches to quicksearch.pro.

ROSE Wallet stores a V0 migration backup of private keys in extension localStorage protected by a KDF 31x weaker than the current standard.

Motrix Next Extension forwards browser download URLs, referrers, cookies, and request headers to the local Motrix Next API.

Read to Me captures DOM snapshots of every page you visit and sends them to Sentry, and transmits page URLs to Amplitude on each user interaction.

Rutor обход блокировки routes browser traffic through a remotely configured proxy and injects clickunder ads on every mouse click.

SEMRush Rank transmits the full URL of each visited tab to rank.trellian.com on every page load and tab switch.

Savings add-on sends merchant names and interaction events to Google Analytics using a persistent identifier, without prompting Chrome users for consent.

Serpstat Website SEO Checker records every URL visited and periodically uploads the full browsing history to plugin.serpstat.com.

ShopNow replaces the default search engine and injects a cookie-derived affiliate tracking parameter into navigations to alphashopnow.co.

Shorts scroller sends YouTube, U-NEXT, and Crunchyroll account/profile and viewing data to me3x.online.