Medium risk browser extensions

Website Ranking and SEO Checker by Semalt sends each visited hostname to Semalt ranking and request-log APIs.

World Clock Tab sends new-tab search queries to sthecfone.com with affiliate/source identifiers.

YouTube Text Tools sends the current YouTube URL, video ID, and stored client/session IDs to its analytics server.

Youtube Playlist Exporter sends a Parse session token to api.letsfaster.com when opening its subscription payment page.

Zecento: Droplist con AI follows remote commands that crawl webpages in hidden frames and send URLs and page content to Zecento.

Zen tab sends your Chrome top-sites URLs to zen-tab.com for Most Visited thumbnails.

iGive Button sends visited site URLs and merchant-page activity to PostHog when its tracking rules match.

impact.com for Chrome sends visited domains to impact.com when publisher-mode affiliation checks run.

unFunnelizer sends video download and conversion page URLs to Google Analytics and its backend.

xMetaCene sends your Twitter/X cookie and engagement activity to x.metacene.io.

AvToolsPro polls av-tools.pro for operations that can fetch Avito pages with your browser credentials.

Eagle includes a payment plugin that selects a payment method and auto-submits forms on Taiwanese payment gateway pages.

PureVPN Proxy sends user email, account ID, device UUID, OS, and VPN session details to its analytics endpoint on every user action.

Reverso sends the current page URL, page title, and a persistent device UUID to its servers with every translation query.

Twitch Ad Blocker fetches remote rules that can redirect pages, open affiliate tabs, and click page elements.

Ads Trust reads Facebook Ads access tokens from business pages and stores them for display in its popup.

AliExpress - Search by Image checks visited hostnames with chat-secreto.es and redirects some pages with the full URL.

Aliexpress Free invoice - AliInvoice rewrites AliExpress shopping pages through an affiliate redirect.

Amazon Review Request Tool ASINsell sends scraped Amazon review profiles and review content to api.asinsell.com.

Calendar View Tab sends new-tab search terms to Yahoo with fixed tracking parameters.

Canned Responses Pro for Jira starts LogRocket session replay on Jira pages and sends Atlassian account and license metadata.

Clarity Tab sends recent bookmark domains to Google's favicon service on its new tab page.

Coupert Guard lets any website change its ad-blocking settings through a page-accessible message bridge.

Eye Saver Tab sends new-tab search queries to eyesavertab-com.s1search.co.

FastApply sends page error telemetry from most pages where its content script runs to its API.

GeoEdge sends account usernames and passwords in tools-api.geoedge.com URL paths during login and user-agent refresh.

Get Movies Info sends searches typed on its new-tab page to r.bsc.sien.com with affiliate parameters.

Google Search Console & Bing Webmaster Tools sends submitted URLs and indexing results to Mixpanel analytics.

Hackertab starts Sentry Replay in its new-tab UI with unmasked text and media and default PII enabled.

Holmes sends unmatched bookmark-search text to Google Search over cleartext HTTP.

Japanese Dictionary JP creates ezse.net grade links containing transcript and grade-table data from student pages.

Kakobuy+ rewrites Kakobuy page URLs to include the hardcoded stannie affiliate code.

Lilo And Stitch Wallpaper reads your top visited sites on each new tab and sends their URLs to Google's favicon service.

Math Equations Anywhere injects a math UI into the active page and loads React scripts from unpkg.com.

Math Tools writes user-triggered screenshots into the active page, where page scripts can read them.

Motrix Next Extension forwards browser download URLs, referrers, cookies, and request headers to the local Motrix Next API.

OnThisDayTab sends new-tab search terms and typed URLs to ext.iadispatcher.com.

One Piece Gear 5 Wallpaper sends your Chrome Top Sites URLs to Google's favicon service on each new tab.

Open in GIMP fetches and downloads a native-client installer from GitHub Releases without verifying its integrity.

Quick Copy saves focused input values, including password fields, to synced extension storage when copy shortcuts run.

Quick Engine Switch routes address-bar search terms through quickengineswitch.com.

QuizGPT sends Kahoot questions and answer choices to api.quizgpt.site and puts its bearer token in pricing-page URLs.

Search Toggler routes default omnibox searches through searchtoggler.com with the typed query in the URL.

Sell The Trend sends detected Shopify store hostnames and Facebook ad metadata to SellTheTrend services.

Squid VPN sends your public IP address to a hardcoded authorization server every minute.

Switch My Search sends default search queries to switchmysearch.com through its search provider and redirect rules.

ToDoNewTab sends new-tab searches or typed URLs with a fixed UID to vmnapi.net.

VUBuddy runs JavaScript fetched from vubuddy.com inside education and course pages.

WA Quick Recruit sends WhatsApp Web page telemetry to Google Analytics and message links to link-preview servers.

WA Web Sender sends the user's WhatsApp phone number and location context to Google Analytics.

WAIX Extension injects WAIX scripts into marketplace pages and sends Taobao/Tmall item details to api.waix.ru.

WhatsApp Privacy Shield injects a Webholix promotional result into Google searches for marketing and web-development terms.

Word of the Day Tab sends new-tab search queries over cleartext HTTP to catloversbackgrounds-com.s1search.co.