Medium risk browser extensions

Greenhub Free VPN can install a PAC proxy that routes ad and tracker domains through Greenhub-controlled proxies.

HBO Max HQ collects viewing history, account PII, and subscription data and transmits them to third-party servers under remote command.

HBOmax Skipper sends account-linked Max profiles, viewing history, and live-event telemetry to external servers.

Homer sends real-estate listing pages, search URLs, listing IDs, and page-view analytics to its APIs.

Hustle sends each keystroke typed into its new-tab search box to hustletab.io for autocomplete suggestions.

IGFollowExporter sends Instagram profile links and user IDs to Cloudflare Worker endpoints during exports.

Inline Lingo Translator removes browser security headers from Google Translate subframe requests and responses.

Jabra Device Connector exposes a native messaging bridge to the Jabra SDK app that any web page can invoke without origin restrictions.

Kimi Copilot sends the URL of each page summarized by the user to PostHog's analytics service alongside a persistent anonymous ID.

Klarway continuously captures screen video, webcam footage, and audio during exams and transmits them to its backend, while broadcasting session credentials to all page scripts.

Lazy Scholar sends scholarly article details, page URLs, tab metadata, and a stored user ID to an AWS API.

Leetify for Codeforces accepts a login session token from any page loaded on localhost:3000, not just its own site.

Linkclump Pro lets webpages synthesize its mouse and key shortcuts to open tabs, windows, bookmarks, or copied links.

Madomi - Manga Translator sends page text, image URLs, and image data to borang.skrin.xyz for translation and summarization.

Magnifying Glass for Google Chrome places a screenshot of the current tab into the page DOM after you click it.

Majestic Mountain Views sets an unbranded third-party site as your browser's default search engine and routes every search through it.

Navigate Rewards scrapes order history from Amazon, eBay, Etsy, and other shopping sites, and Reddit content, then forwards it to prod.socialsurfer.xyz.

Net-Pocket reads product details from shopping pages using remote selectors and sends them to api.net-pocket.com.

Netflix 同時字幕で英語学習 stores a Google Sign-In ID token in Netflix page localStorage.

Omni renders tab, bookmark, and history details into every page's DOM when its command menu is used.

OneScholar writes saved settings, including API keys, into page-accessible storage and form fields during backup/export.

Online Dictionary Helper fetches selected dictionary scripts from GitHub or custom URLs and runs them in its sandbox.

Online Weather Forecast sends typed new-tab search queries to transitschedules.net before search submission.

Open in IE downloads a native client binary from GitHub without checksum or signature verification.

PDF Manuals routes address-bar searches to pdfmanuals.net and maintains a five-year UID cookie for that site.

PDF Translator ships recoverable Alibaba OSS access key material in its popup source.

Page Sidebar strips X-Frame-Options and CSP headers globally and grants camera, microphone, geolocation, and clipboard to any framed page.

PageTurn EPUB Reader runs scripts embedded in user-opened EPUB files inside its reader iframe.

Paint Tool by Painty sends top-site hostnames for favicon lookup and typed search text for autocomplete.

Ping Network VPN computes a browser/device fingerprint in the popup and sends its components to pingvpn.xyz.

Poshmark | PosherVA can send Poshmark session cookies to PosherVA-controlled Firebase storage on remote command.

Prime Sender sends WhatsApp account details and Chrome profile email to vendor and analytics endpoints.

Pure Planet Earth sets itself as your default search engine and stamps every search you make with a persistent tracking ID.

Quick Spotify Search sends address-bar searches to chromecrxstore.com while labeling the provider Google.

RYS exposes the MD5 hash of its settings-lock password to YouTube pages as a DOM attribute.

Recipe Search tags default-search queries with a persistent extension GUID and campaign type before redirecting them.

Rocket Sender automates WhatsApp messaging and decides where to activate from a class-name list fetched from its remote config server.

Screen Dimmer loads a hidden onlineapp.pro paywall iframe on every page you visit.

Search All routes Amazon and eBay searches through affiliate links and injects a promotional iframe into Google results.

Ship Xanh accepts localhost messages that can replace its stored account token.

Side Panel for Gemini removes security headers from every page in the browser and sets Access-Control-Allow-Origin to wildcard on install.

SignUp sends streaming page URLs and titles with a persistent analytics ID to its backend and Google Analytics.

Simple Video Download Helper sends the current page URL and user API key to a third-party server when the popup is opened.

Skip AliExpress Bundle Deals: Just This One! sends AliExpress product URLs and shipping country to a developer Worker.

Sticky Note Board Extension redirects new-tab search queries to search.notesticky-extension.com with an affiliate tracking ID.

TOTP Authenticator reads Firebase account data and decrypts it with a key derived only from the user's email address.