Medium risk browser extensions

Art New tabs sends new-tab search terms to goog.artnewtabs.com.

AsinSeed sends an MD5-derived password value in the sign-in URL query string to www.asinseed.com.

Authenticator App forwards autofill requests for credential fields to a localhost WebSocket using bundled AES key material.

Autofill Taobao Tracking No. & Shipping Info records matched tab URLs and sends domains to AliPrice endpoints.

BestWallpaper NewTab Extension sends new-tab search queries to best.bestwpnew-tab.com with a fixed affiliate tracking ID.

Beyond Meet for Google Meet returns its Google Drive OAuth access token to scripts running on meet.google.com.

BitLy sends each shortened URL to Bitly and a plaintext n8n webhook.

Block Site Ex requests all-sites access and browser network-rule permissions to block configured websites.

Bookmark Drag and Drop sends new-tab search terms to search.bookmark-folders.com with a fixed tracking token.

Bounce off the Wall sends new-tab search queries to ehereugo.com with fixed partner identifiers.

ClickUp BrainMax sends the user's real IP address, country, OS, and a device UUID to the Singular attribution SDK on install and on each login.

BuxMoney follows remote tasks that navigate, click, scroll, play media, and inject scripts in its autosurf window.

Casper Wallet sends visited merchant URLs and the active wallet public key to api.bringweb3.io for its BringWeb3 integration.

ChatGPT Delete All Chats computes a persistent browser fingerprint on chatgpt.com and sends it to antonkhoteev.com on every API call.

ChatGPT Extension uploads user-selected image attachments to ImageBB before sending them to ChatGPT.

CiteMaker CiteWeb sends login passwords in GET requests to citemaker.com during popup sign-in.

Cityscapes sends each Chrome top-sites URL to Google's favicon service when it renders the new-tab page.

Claap removes Bubbles and Loom companion widgets from productivity sites where its content script runs.

Comunidade ZDG FREE fetches and eval-executes a GitHub script inside WhatsApp Web after WhatsApp tabs load.

Cookie Guard writes detected affiliate cookie details into page-visible alerts and sessionStorage.

Cool Cursors redirects Google search pages to ugnewtab.net with the user's original search query.

Coupons Search sets searchext.com as your default search engine, routing every address-bar query through a Yahoo-syndication redirect.

Currency Helper sends searches from its new-tab page to goog.currencyhelperext.com.

DashBlox fetches privacy-policy Markdown from GitHub and injects the converted HTML into its Roblox settings page.

DealsUpp - Contact Saver for WA injects a WhatsApp helper that sends page and session telemetry to Google Analytics.

Dictionary, Thesaurus & Reference opens selected or typed lookup terms in cleartext dictionary URLs.

Discord VPN routes Discord and non-Discord account and payment domains through extension-configured proxy servers.

Download Aliexpress Product Images & Videos rewrites AliExpress shopping pages through an affiliate deep-link endpoint.

Downloader for Microsoft Text-to-Speech sends synthesize and account telemetry to Amplitude.

Dragon Wallpaper sends up to 10 Chrome top-site URLs to Google's favicon service on its new-tab page.

Drop Tab sends weather location lookups to geoiplookup.io and droptab.net, and adds install IDs to new-tab searches.

The extension sends Wildberries seller profile and supplier contact data to Eggheads.

ESUIT Mass Friends Remover for Facebook exposes stored ESUIT profile and subscription data to Facebook-scoped pages.

Easy Login sends Gamer.com.tw page-load hostnames to Google Analytics with a persistent client ID.

EasyKOL intercepts Instagram and TikTok API responses to collect creator profile, post, video, and hashtag metrics.

Explore Beach sends new-tab search queries to searchtsm.com with an affiliate campaign parameter.

Fabasoft Folio 2020 relays cookies from any visited page to the local Fabasoft native host when a first-caller web page opens the messaging channel.

FashionReps Link Converter rewrites shopping and registration pages to URLs with hardcoded referral codes.

Firewall Bypass vu loads a remote jsPDF library from cdnjs into VULMS pages.

Flash Player Extension For Web sends page URLs and device/IP details to an Aliyun log endpoint.

FlashSale AutoBuy sends shopping product URLs and popup tab details with stored location fields to buydekhke.com and unscart.com.

Flow Wallet stores Google Drive wallet backups with an encryption key shipped in the extension bundle.

Force.com LOGINS stores Salesforce account passwords in extension localStorage without protection by default.

GHL Cloner sends a persistent client ID and public IP address to Google Analytics on startup and hourly alarms.

Games Search recreates its vendor-domain ID and user-agent cookies after they are deleted.

Get Catapult sends new-tab search queries to newsubmission-com.s1search.co over cleartext HTTP.

GetSystemMonitor sends new-tab search terms to nthecfone.com with fixed campaign identifiers.

Goku Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

Howdou for Google Classroom sends the signed-in teacher's email address and assignment IDs to embed.howdou.net on every interaction.

IRCTC TatkalMate stores IRCTC login and payment fields in local browser storage encrypted with a hardcoded key.

ITA Matrix Powertools sends clicked booking links and the current Matrix page URL to Skimresources by default.

InFormEnter+ generates profile passwords with Math.random instead of a cryptographic random source.