Medium risk browser extensions

Change Timezone (Time Shift) accepts timezone-override commands from any page, with no check on who sent them.

ChatGPT Delete All Chats computes a persistent browser fingerprint on chatgpt.com and sends it to antonkhoteev.com on every API call.

ClassroomGo embeds a hardcoded YOURLS API signature in its bundle, allowing any party with source access to create short URLs on gtogo.to.

Classwork Zoom can upload Google Classroom and Drive API responses when server-controlled logging is enabled.

Claude Tuner sends snapshot submissions to its backend using a shared fallback API key.

CookieCloud reads all browser cookies and uploads an encrypted copy to a third-party server every 10 minutes.

Dark Theme - Custom New Tab sends new-tab search terms to find.wsrcnav.com with fixed tracking parameters.

Data Dive removes X-Frame-Options from subframe responses across all websites.

This extension toggles Disney Plus video into a custom-fit ultrawide fullscreen view.

Doodle games collection removes Content-Security-Policy and X-Frame-Options headers across all sites.

Download Station sends NAS login passwords over HTTP when users keep its default http://diskstation:5000 settings.

Dropified Dropshipping accepts external messages that can use your AliExpress session to edit carts and read order details.

ESUIT | Un Seen for Facebook removes Content-Security-Policy headers on Facebook and Messenger pages.

EasyClaw Browser Assistant lets a localhost relay send Chrome DevTools commands through the extension.

EasyKOL intercepts Instagram and TikTok API responses to collect creator profile, post, video, and hashtag metrics.

Email Scraper for Ins uploads extracted Instagram lead records to remote-configured Echobot endpoints.

Embed YouTube videos directly into Gmail messages from the compose window.

FLG accepts login tokens from page events and uses them for FLG Platform API requests.

FMHY SafeGuard fetches unsafe-site reason text from GitHub and inserts it into search results as HTML.

Fable sends active-tab URLs to Segment and accepts page messages that forward URLs and page snippets to Fable.

FaniMani.pl Donation Reminder sends visited page URLs with a persistent user identifier to FaniMani stats and Google Analytics.

Fast Wallet sends biometric auth keys and a persistent device identifier to api.suiet.app, a third-party server, during biometric setup.

Firewall Bypass vu loads a remote jsPDF library from cdnjs into VULMS pages.

Quick Grammar Fixer & AI Proofreader sends selected or typed text to a Vercel-hosted grammar API when you check grammar.

Flash Player EmuFlash lets sandboxed Flash content send arbitrary web requests through the extension.

Force.com LOGINS stores Salesforce account passwords in extension localStorage without protection by default.

Free AI ReCaptcha Solver by Raptor stores solved reCAPTCHA images and labels and uploads them to captcharaptor.com.

Funkify - Disability Simulator lets parent pages trigger clicks inside cross-origin iframes through its content script.

Greenhub Free VPN can install a PAC proxy that routes ad and tracker domains through Greenhub-controlled proxies.

Hustle sends each keystroke typed into its new-tab search box to hustletab.io for autocomplete suggestions.

IDM - Trial Reset Tool 2026 lets pages trigger its optional widget to clear that site's cookies and browser storage.

IGFollowExporter sends Instagram profile links and user IDs to Cloudflare Worker endpoints during exports.

Inline Lingo Translator removes browser security headers from Google Translate subframe requests and responses.

Jabra Device Connector exposes a native messaging bridge to the Jabra SDK app that any web page can invoke without origin restrictions.

Kimi Copilot sends the URL of each page summarized by the user to PostHog's analytics service alongside a persistent anonymous ID.

Lazy Scholar sends scholarly article details, page URLs, tab metadata, and a stored user ID to an AWS API.

Lector Biblioteca Ceibal lets approved reading sites query and remove matching browser bookmarks.

Linkclump Pro lets webpages synthesize its mouse and key shortcuts to open tabs, windows, bookmarks, or copied links.

Madomi - Manga Translator sends page text, image URLs, and image data to borang.skrin.xyz for translation and summarization.

Majestic Mountain Views sets an unbranded third-party site as your browser's default search engine and routes every search through it.

MeowLoad lets any web page ask it to open a supplied URL in a new browser tab.

Naruto Wallpaper sends up to 10 top-site URLs from the new tab page to Google's favicon service.

Navigate Rewards scrapes order history from Amazon, eBay, Etsy, and other shopping sites, and Reddit content, then forwards it to prod.socialsurfer.xyz.

Net-Pocket reads product details from shopping pages using remote selectors and sends them to api.net-pocket.com.

Netflix 同時字幕で英語学習 stores a Google Sign-In ID token in Netflix page localStorage.

Omni renders tab, bookmark, and history details into every page's DOM when its command menu is used.

OneScholar writes saved settings, including API keys, into page-accessible storage and form fields during backup/export.

Online Dictionary Helper fetches selected dictionary scripts from GitHub or custom URLs and runs them in its sandbox.