Medium risk browser extensions

View PDF's sends every search keystroke and uploaded documents to viewpdf.org and ConvertAPI, which stores files on their servers.

View Rendered Source sends the analyzed page URL, user-agent, and locale to Beam Analytics each time the extension is invoked.

Web Color Inverter Tool sends each completed tab navigation's hostname with a persistent UUID to tracker01.paradisesv.net.

Web Shield routes browser search queries and suggestions through dealsearcherplus.com domains.

Web Translator overrides the browser's default search engine and new tab page to route all searches through search.web-translater-tab.com.

Wildbox reads Wildberries' session and anti-bot cookies on wildberries.ru and attaches them to requests sent to wildbox.ru.

The extension intercepts AliExpress checkout responses and reads session cookies to automate order placement and shipping configuration.

YouTube Monetization & RPM Checker by TubeLab sends YouTube channel RPM and monetization details to TubeLab servers.

The extension fetches remote config from GitHub daily and runs scripts in every open browser tab on a remotely controlled schedule.

The extension periodically fetches a PAC script from yiban.io and applies it as the system-wide Chrome proxy, routing all browser traffic through a remotely-controlled configuration.

SMART DATA sends buyer PII and customs codes to unipass.customs.go.kr via a hardcoded API key, and sends session data over plaintext HTTP.

Song Identifier captures a 5-second audio fingerprint from active tab media and sends it to ACRCloud, using hardcoded API credentials.

VPN add-on transmits a canvas and WebGL device fingerprint to api.uvpn.me on every sign-in, and sends account-linked telemetry to analytics.uvpn.me.

Lightshot sends screenshot image data to its upload server over unencrypted HTTP.

Quick Recipe Hub & Custom Web Search sets Yahoo as the default search engine with affiliate tracking parameters appended to every query.

Trending News & Search redirects user searches to Yahoo using hardcoded affiliate tracking codes with no disclosure to users.

2chRevival fetches a plaintext URL list from websvc2.jpn.org to drive archived-thread revival requests.

Aggilizador stores broker credentials and auto-submits them on insurer login pages.

Ali Insider silently redirects AliExpress product pages through affiliate URLs and sends browsing data to its own servers.

Ali Invoice FREE reroutes AliExpress product and store clicks through alitems.link affiliate tracking.

AliBill sends AliExpress order details to api.alibill.net and mirrors product/store clicks to an affiliate endpoint.

All Doodle games removes Content-Security-Policy and X-Frame-Options headers across all URLs.

AutoBuy Flash Sales, Deals, and Coupons sends shopping-page URLs to its coupon service and rewrites Flipkart product clicks.

AutoSail for Midjourney intercepts your account API responses to collect your email address and forwards it to Google Analytics and a third-party license server.

Avantpro AMZ contacts its Scrapo alerts backend with a bundled API key on Amazon pages.

Better Lyrics Shaders sends YouTube Music track metadata to artwork.boidu.dev for animated art.

BuxBack - Earn R$ has no confirmed reviewed findings in the scanner yet.

Cats Fan sends new-tab search queries to cats.catsfanext.com with an affiliate tracking ID.

Change Timezone (Time Shift) accepts timezone-override commands from any page, with no check on who sent them.

ClassroomGo embeds a hardcoded YOURLS API signature in its bundle, allowing any party with source access to create short URLs on gtogo.to.

Classwork Zoom can upload Google Classroom and Drive API responses when server-controlled logging is enabled.

Claude Tuner sends snapshot submissions to its backend using a shared fallback API key.

CookieCloud reads all browser cookies and uploads an encrypted copy to a third-party server every 10 minutes.

Dark Theme - Custom New Tab sends new-tab search terms to find.wsrcnav.com with fixed tracking parameters.

Data Dive removes X-Frame-Options from subframe responses across all websites.

Doodle games collection removes Content-Security-Policy and X-Frame-Options headers across all sites.

Download Station sends NAS login passwords over HTTP when users keep its default http://diskstation:5000 settings.

ESUIT | Un Seen for Facebook removes Content-Security-Policy headers on Facebook and Messenger pages.

EasyClaw Browser Assistant lets a localhost relay send Chrome DevTools commands through the extension.

EasyKOL intercepts Instagram and TikTok API responses to collect creator profile, post, video, and hashtag metrics.

Email Scraper for Ins uploads extracted Instagram lead records to remote-configured Echobot endpoints.

FLG accepts login tokens from page events and uses them for FLG Platform API requests.

FMHY SafeGuard fetches unsafe-site reason text from GitHub and inserts it into search results as HTML.

FaniMani.pl Donation Reminder sends visited page URLs with a persistent user identifier to FaniMani stats and Google Analytics.

Fast Wallet sends biometric auth keys and a persistent device identifier to api.suiet.app, a third-party server, during biometric setup.

Flash Player EmuFlash lets sandboxed Flash content send arbitrary web requests through the extension.

Free AI ReCaptcha Solver by Raptor stores solved reCAPTCHA images and labels and uploads them to captcharaptor.com.