Medium risk browser extensions

Safesearch Lab sets itself as the default search engine and routes queries through a tracking redirect before reaching Yahoo.

Satoru Gojo: Unleash the Power of Jujutsu! Gameograf fetches remote Gameograf HTML and injects it into its new-tab page.

Search by image on Amazon sends visited page URLs to apiheaven.io and may redirect a tab through apiheaven.io/pulse.

Search to Play the Song sends NetEase searches and playback lookups over cleartext HTTP.

Secure Shield by Secure Shell redirects Google and Bing searches to Secure Shield Search with the original query.

SeekIt sends search queries and browser context telemetry to analytics.seekit.com when users use search.seekit.com.

Skip AliExpress Bundle Deals: Just This One! sends AliExpress product URLs and shipping country to a developer Worker.

Smart LG TV Remote Controller sends TV pairing keys and remote-control commands over cleartext local HTTP and WebSocket connections.

SnakeyRain exposes saved Slither credentials to page scripts through a CustomEvent bridge on slither.io and slither.com.

SocialHub Plus Mix stores its bearer token and account email in WhatsApp Web localStorage.

Solo Leveling Wallpaper sends top-site URLs from the new-tab page to Google's favicon service.

Sound Recorder loads a bundled ad SDK that reports the origin of every page you visit to a third-party ad server.

Spending Calculator for Amazon and Flipkart sends Amazon and Flipkart account contact details to sc.ecombullet.com.

Sticker Mania injects Google Fonts links into every HTTP and HTTPS page, sending page URLs as referrers to Google.

StockGlow sends each visited page's domain and path plus stock-detection events to Mixpanel with a persistent extension ID.

StylerGPT for ChatGPT sends a keyed hash of the user's ChatGPT email to api.stylergpt.com for trial checks.

THunt Image Downloader collects Temu product and store page data and sends it to temuhunt.com.

Tab Manager for Chrome exposes current-window tab titles to pages when its overlay is opened.

Telegram Blur - Advanced Telegram Web Privacy contacts ads.brainosia.com from an all-sites content script.

Temporary Contacts sends new-tab search terms to api.tempcontacts.com before running the search.

The QR Extension sends the active tab URL to dynamic QR shortening endpoints when the popup opens.

Tipli sends text scraped from matched shopping pages, along with the full page URL, to www.tipli.ro.

Toca Life: World sends your Chrome top-sites URLs to Google's favicon service when its new-tab page loads.

Top Green Search appends a persistent session ID to searches sent to topgreenview.com.

Total Privacy For WhatsApp Web requests ads.brainosia.com from every page a user opens.

Trackerbot sends full e-commerce page HTML to its odd-jobs server when server-supplied debug flags request templates.

Transtore fetches remote rules from storefront.transtore.app and injects configured HTML into matched sites.

Travel Backgrounds forwards new-tab search terms to searchtravelbg.com.

Treble.ai HubSpot Integration places the stored Treble API key in a page-visible HubSpot iframe URL.

Tropical Horizons Wallpapers sends new-tab search queries to trop.tropicalhorizon-ext.com.

Tubi Ad Skipper sends Tubi account identity, continue-watching data, and playback events to me3x.online.

Tyler Hearing Fan Tab sends new-tab search queries to addents-leasure.icu.

UAR_SKT captures the full page DOM on every navigation and forwards matching URLs to a locally installed SKT corporate management application via native messaging.

Ultimate Basketball Fan Extension sends new-tab search queries to search.basketball-fan.com with a tracking ID.

Up Assistant uses remote rules to redirect matched pages and log the original and redirect URLs to ali-stat.info.

Utorrent For Chrome sends saved uTorrent Basic Auth credentials to non-magnet links opened from its context menu.

VK AD SKIP sends VK video viewing details and account identifiers to vkadskip-api.star-tech.dev.

VPNtube sends selected proxy credentials to any site that asks for HTTP authentication while its VPN is enabled.

Video Downloader Pro sets chromeapps.site as the default search provider for omnibox searches.

Video Dual Subtitles sends Vimeo caption translation requests and tab details to Amplitude analytics.

Video Recorder exposes camera and microphone device inventory to any page that embeds its permissions screen.

Video Speed Controller Pro sends visited site hostnames and video speed changes to www.tinyflash.org.

Viral Vue sends supported-site page URLs to api-iris.viralvue.com during session checks.

Voicenter Contact Center stores Voicenter IDs and call-status data in the active website's localStorage when its strip panel opens.

Voicy uploads user-triggered microphone recordings with the current site hostname to its transcription API.

WA Bulk Message Sender Extension sends WhatsApp Web telemetry to Google Analytics and message-preview URLs to preview servers.

WA Group Number Exporter sends your WhatsApp account phone number in telemetry to Alibaba Cloud SLS.

WA Message Sending Bot sends WhatsApp page analytics and a persistent client ID to Google Analytics.

WADirect Message sends links in WhatsApp messages to third-party link-preview services before delivery.

WAPI PREMIUM - Jaguar imports remote code into WhatsApp and stores WAPI login credentials in page localStorage.

WAPremium MultiWeb stores its ChatCenter bearer token in WhatsApp Web localStorage.

Watch TV sends new-tab search terms to watchtvonline.org as users type.

Web Search redirects default searches with a persistent extension GUID to search.websearchextension-api.info.

Weblio エクステンション sends selected page text to api.weblio.jp in an embedded quote iframe.