Medium risk browser extensions

Side Panel for Gemini removes security headers from every page in the browser and sets Access-Control-Allow-Origin to wildcard on install.

Simple Allow Copy routes Chrome updates through agency.pictureknow.com and injects server-controlled affiliate links into shopping pages.

Slice New Tab fetches server-controlled redirect rules from api.addslice.com and applies them to browsing traffic when the '<all_urls>' permission is granted.

SmartSolve captures screenshots and selected text from any tab and transmits them to api.smartsolve.ai, while suppressing browser events to conceal itself from exam platforms.

Smartschool++ ships plaintext third-party API keys and fetches server-supplied URLs without validation.

Street View Maps renders remote HTML from its own server into the new tab page without sanitization and transmits every search keystroke to its server.

Talis Reading Lists Bookmarking sends the URL of any site you click its toolbar on to Google Analytics with a persistent install ID.

Transfer Dropbox to Google Drive uses a hardcoded AES-128-ECB key to decrypt all API responses from its backend, exposing user data to any party with access to the extension source.

Tree Style Tab sends user interaction telemetry to Google Analytics, including IP-derived location and a persistent tracking UUID.

Trusted Browse overrides the default search engine and redirects Google and Bing searches to a Yahoo-affiliate proxy.

Udemy Dual Subtitles sends tab URL, tab title, and a persistent user UUID to its own backend and to Amplitude on every subtitle translation request.

Ultra Volume Booster captures tab audio to amplify volume and sends usage telemetry to Google Analytics on startup and hourly.

Undetectable AI sends selected page text to its detection, humanizing, paraphrasing, and citation endpoints when you use its tools.

Unfollower Tracker for IG receives server-controlled extraction patterns and can open arbitrary URLs on command from besocial.top.

The extension fetches its proxy configuration and PAC script from remote servers with no integrity verification.

View PDF's sends every search keystroke and uploaded documents to viewpdf.org and ConvertAPI, which stores files on their servers.

View Rendered Source sends the analyzed page URL, user-agent, and locale to Beam Analytics each time the extension is invoked.

Watch Party for Disney Plus reads your Disney+ watch history, account and profile data and sends it to gathermetrics.live.

Web Color Inverter Tool sends each completed tab navigation's hostname with a persistent UUID to tracker01.paradisesv.net.

Web Shield routes browser search queries and suggestions through dealsearcherplus.com domains.

Web Translator overrides the browser's default search engine and new tab page to route all searches through search.web-translater-tab.com.

Wildbox reads Wildberries' session and anti-bot cookies on wildberries.ru and attaches them to requests sent to wildbox.ru.

The extension intercepts AliExpress checkout responses and reads session cookies to automate order placement and shipping configuration.

YouTube Monetization & RPM Checker by TubeLab sends YouTube channel RPM and monetization details to TubeLab servers.

Youtube Summary With AI sends page URLs and video metadata to PostHog analytics when users trigger AI features.

VOT Voice Over Translation exposes a page-reachable bridge that runs credentialed fetches and reads extension storage.

The extension fetches remote config from GitHub daily and runs scripts in every open browser tab on a remotely controlled schedule.

The extension periodically fetches a PAC script from yiban.io and applies it as the system-wide Chrome proxy, routing all browser traffic through a remotely-controlled configuration.

SMART DATA sends buyer PII and customs codes to unipass.customs.go.kr via a hardcoded API key, and sends session data over plaintext HTTP.

Song Identifier captures a 5-second audio fingerprint from active tab media and sends it to ACRCloud, using hardcoded API credentials.

VPN add-on transmits a canvas and WebGL device fingerprint to api.uvpn.me on every sign-in, and sends account-linked telemetry to analytics.uvpn.me.

Lightshot sends screenshot image data to its upload server over unencrypted HTTP.

Quick Recipe Hub & Custom Web Search sets Yahoo as the default search engine with affiliate tracking parameters appended to every query.

Majestic Mountain Views sends every new-tab search query to landscape-extensions.com instead of your default search engine.

City Scapes sends every new-tab search query to a third-party monetized search proxy instead of your browser's default search engine.

Beautiful Beaches sends new-tab search queries to a third-party search proxy instead of the browser's default search engine.

Trending News & Search redirects user searches to Yahoo using hardcoded affiliate tracking codes with no disclosure to users.

2FA Authenticator Guard encrypts no-login TOTP secrets with a hardcoded password stored in the extension code.

2chRevival fetches a plaintext URL list from websvc2.jpn.org to drive archived-thread revival requests.

AYAYADASH - Anime Dashboard sends the user's IP address to ip-api.com to load weather for its new-tab page.

Adblock for YouTube Block Ads Skip Video Sponsored rewrites matching merchant tabs to affiliate links from Google Sheets.

Aggilizador stores broker credentials and auto-submits them on insurer login pages.

Ali Insider silently redirects AliExpress product pages through affiliate URLs and sends browsing data to its own servers.

Ali Invoice FREE reroutes AliExpress product and store clicks through alitems.link affiliate tracking.

AliBill sends AliExpress order details to api.alibill.net and mirrors product/store clicks to an affiliate endpoint.

All Doodle games removes Content-Security-Policy and X-Frame-Options headers across all URLs.

AutoBuy Flash Sales, Deals, and Coupons sends shopping-page URLs to its coupon service and rewrites Flipkart product clicks.

AutoSail for Midjourney intercepts your account API responses to collect your email address and forwards it to Google Analytics and a third-party license server.

Avantpro AMZ contacts its Scrapo alerts backend with a bundled API key on Amazon pages.

Better Lyrics Shaders sends YouTube Music track metadata to artwork.boidu.dev for animated art.

BuxBack - Earn R$ has no confirmed reviewed findings in the scanner yet.

Cats Fan sends new-tab search queries to cats.catsfanext.com with an affiliate tracking ID.