Medium risk browser extensions

Online Weather Forecast sends typed new-tab search queries to transitschedules.net before search submission.

Open bookmarks in a new tab lets its bookmark proxy page redirect the current tab to a URL chosen in the page address.

Open in IE downloads a native client binary from GitHub without checksum or signature verification.

PDF Manuals routes address-bar searches to pdfmanuals.net and maintains a five-year UID cookie for that site.

PDF Translator ships recoverable Alibaba OSS access key material in its popup source.

Page Sidebar strips X-Frame-Options and CSP headers globally and grants camera, microphone, geolocation, and clipboard to any framed page.

PageTurn EPUB Reader runs scripts embedded in user-opened EPUB files inside its reader iframe.

Paint Tool by Painty sends top-site hostnames for favicon lookup and typed search text for autocomplete.

Ping Network VPN computes a browser/device fingerprint in the popup and sends its components to pingvpn.xyz.

Poshmark | PosherVA can send Poshmark session cookies to PosherVA-controlled Firebase storage on remote command.

Prime Sender sends WhatsApp account details and Chrome profile email to vendor and analytics endpoints.

Print Notion stores your Notion access token in chrome.storage.sync instead of local storage, so it syncs across your Chrome devices.

Pure Planet Earth sets itself as your default search engine and stamps every search you make with a persistent tracking ID.

Quick Spotify Search sends address-bar searches to chromecrxstore.com while labeling the provider Google.

RYS exposes the MD5 hash of its settings-lock password to YouTube pages as a DOM attribute.

Recipe Search tags default-search queries with a persistent extension GUID and campaign type before redirecting them.

Rocket Sender automates WhatsApp messaging and decides where to activate from a class-name list fetched from its remote config server.

Screen Dimmer loads a hidden onlineapp.pro paywall iframe on every page you visit.

Captures visible or full-page screenshots of webpages with annotation and saving options.

Search All routes Amazon and eBay searches through affiliate links and injects a promotional iframe into Google results.

Ship Xanh accepts localhost messages that can replace its stored account token.

SignUp sends streaming page URLs and titles with a persistent analytics ID to its backend and Google Analytics.

Simple Video Download Helper sends the current page URL and user API key to a third-party server when the popup is opened.

Skip AliExpress Bundle Deals: Just This One! sends AliExpress product URLs and shipping country to a developer Worker.

Sticky Note Board Extension redirects new-tab search queries to search.notesticky-extension.com with an affiliate tracking ID.

TABLERONE tab manager lets matching external pages request active-tab and saved-session metadata.

TOTP Authenticator reads Firebase account data and decrypts it with a key derived only from the user's email address.

TTNote sends TikTok and Denote interaction telemetry with page URLs and user identifiers to Aliyun Log Service.

Tab Suspender exposes open-tab titles, URLs, and favicon URLs to pages when its tab manager is opened.

Text Spotlight sends entered URLs to edurls.org to create shortened links or QR codes.

TextOptimizer exposes a UI that web pages can use to send active-tab page and form content to its APIs.

Tool 42 loads the remotejs.com agent into its extension page when opened with a debug hash.

Topview AI extension lets any web page seed its social publishing state and open supported social platform tabs.

Traffic Ad Bar Surf Bar removes frame protections and rewrites subframe request headers in its Traffic Ad Bar tabs.

Transit Schedules renders unsanitized remote HTML in the new tab page and sends search queries and geolocation data to transitschedules.net.

Translate sends user-selected text from any website to Google Translate when the translate icon is clicked.

Triton Tab sends IP-derived latitude and longitude to its weather API over cleartext HTTP.

USC Schedule Helper saves notification email and phone entries in USC WebReg page storage.

UrbanTabs sends searches typed on its new-tab page to bseeksrc.com.

Utorrent For Chrome sends saved uTorrent Basic Auth credentials to non-magnet links opened from its context menu.

VK Music Player embeds a Last.fm API secret and removes response security headers for pages it loads.

Video Speed Controller Pro sends visited site hostnames and video speed changes to www.tinyflash.org.

VideoTogether lets any webpage use its bridge to read whitelisted service responses and write records into extension storage.

View Manuals sends every keystroke typed in its search bar to viewmanuals.com in real time.

Vivid Sparkles sends new-tab search queries with persistent install identifiers to search.vividsparkles.net.

WA Toolbox by Elbruz Technologies sends deleted WhatsApp message bodies and call records to its Firebase project.

WAPPMASTER Contacts Extractor sends the WhatsApp account number it reads from web.whatsapp.com storage to Aptabase.

WARocket Sender injects WA-JS into WhatsApp Web and sends page telemetry with a persistent client ID to Google Analytics.

WADeck reads your WhatsApp phone number and sends URLs from private conversations to third-party link-preview servers.

Wingman Clock sends new-tab search queries to goog.Wingmanclock.com with an affiliate tracking ID.

Worldwide Clock Extension sends new-tab search queries to search.worldwideclockextension.com with a fixed traffic ID.