Medium risk browser extensions

IG Comment Export Tool sends Instagram comment API responses and export settings to Alibaba Cloud SLS.

Instagram Video Photo Download - IG Downloader forwards Instagram API responses to a hardcoded extension ID.

International Jobs by Leapfrog scrapes LinkedIn page details with server-provided selectors and sends them to Leapfrog's backend.

Itzuli+ sends selected text and microphone recordings from any web page to Basque Government translation APIs.

JDM Cars Wallpaper New Tab sends new-tab search queries to tabssearch.com.

JoomPulse forwards intercepted Shopee marketplace API responses to joompulse.com.

LeetCode Timer sends LeetCode submission code and timing details to codelytics.app after submission checks.

Live Transcript Extension includes hardcoded Symbl.ai credentials used to request speech API tokens.

Livescratch lets Scratch pages request its stored LiveScratch bearer token through an external messaging bridge.

Lyrics ( Youtube / Youtube Music ) inserts lyrics.co.kr responses as HTML into YouTube pages.

M3U8 Downloader fetches and merges HLS video segments from user-supplied URLs and saves them locally as .ts or .mp4 files.

MCP SuperAssistant sends page URLs, titles, environment details, and a persistent client ID to Google Analytics.

Malware & URL Scanner sends scanned URLs and domains to multiple reputation APIs, including several over HTTP.

MetricMaster sends searches typed on its new tab page to meter.metermaster-ext.com with a fixed tracking ID.

Microsoft Bing InPrivate sends a persistent machine ID and browser details to g.ceipmsn.com over HTTP.

MillionPugs disables installed ad blockers during its cashback redirect flows.

My Fpoly Extension disables development extensions and a fixed extension ID from pages on poly.edu.vn.

My Online Learning Downloader sends the page user object and current URL to its telemetry API when downloads start.

MyCoub loads a remote stylesheet on Coub pages and can send captured video frames to Yandex Images.

MyToDo sends new-tab search queries to goog.mylistodo.com with a fixed tracking ID.

Naruto Wallpaper sends up to 10 top-site URLs from the new tab page to Google's favicon service.

Nature Extension sends precise geolocation to OpenWeatherMap and top-site hostnames to Google's favicon service.

NeoLine lets any web page request the selected Neo N3 wallet address and token balances.

New Tab Search Assistant 52 sends new-tab searches over cleartext HTTP to mybrowserbar.com.

Neymar - Football Live Wallpaper sends saved shortcut URLs to Google's favicon service when its new tab page opens.

Node Inspector Manager sends Chrome profile identity and debugger session details to analytics services.

OKIOCAM Time-Lapse makes uploaded webcam time-lapse files readable to anyone with the Google Drive link.

CROSSx lets any HTTPS page switch the wallet's active chain through its injected page bridge.

Official Card Counter Trello with Totalizer redirects visits to shopping sites through affiliate links.

Offline QR Code Generator sends the active tab URL to QR-shortener endpoints when making a code by default.

Online AntiVirus Protection sends visited page URLs and referrers to analytics.chromeapps.site with a persistent UUID.

Open Two-Factor Authenticator stores TOTP secrets in sync storage using password-hash AES encryption.

Overprice sends page URLs to overprice.app and can return server-directed page content extractions.

Page Load Stats fetches remote rules that can inject chosen scripts into matching visited sites.

PageTurn EPUB Reader runs scripts embedded in user-opened EPUB files inside its reader iframe.

Password Generator sends new-tab search or URL input to isrcfornow.com with affiliate parameters.

Personalized Backgrounds sends new-tab search queries to goog.personalizedbackground.com.

Pianoic replaces the new tab with a search box that sends entered searches or URLs to rsrc2u.com.

Pixdownify Image Downloader sends hourly Google Analytics heartbeat events with a persistent extension client ID.

Play to Kodi sends Kodi JSON-RPC credentials to the configured media server over HTTP.

Plus collects cookies from every third-party domain a captured page's resources come from, then uploads them with each snapshot.

Prime Connect - Message Sender sends WhatsApp phone-number and location analytics to Google Analytics.

Prime Party Extended [QVI] sends Amazon and Prime Video account details and remotely requested viewing data to its servers.

Prime Sender sends WhatsApp account details and Chrome profile email to vendor and analytics endpoints.

Privacy Extension for WhatsApp Web sends WhatsApp page telemetry and a persistent client ID to Google Analytics.

Product Image Downloader sends page URLs, user-agent details, and generated IDs to a hardcoded Slack webhook.

Progressive Shopper sends each HTTPS page's hostname to progressiveshopperapi.com when pages load.

Promo Coders sends visited site domains and Google result domains to getutintsofthe.org for coupon lookups.

Random number generator redirects matching site visits through a bit.ly URL that appends the current page URL.

Reader Mode - Natural Reader and dark mode sends visited page URLs and referrers to cleaner.reader-view.com.

RecipeSearch force-navigates the user's active tab to its own landing page immediately after install, with no user action.

Ricoh Cloud Print uploads selected print documents and printer settings to Ricoh's cloud API.