Medium risk browser extensions

Youtube Video Skip Ad Trigger sends each YouTube URL you visit to Google Analytics, tied to a persistent per-user UUID.

Youtube to Transcript injects a script into the active tab letting its vocabulary.live iframe read and write the page DOM and localStorage.

cat-catch lets any HTTP(S) page send background commands that can turn on auto-download and queue media URLs.

eckoWALLET sends matched shopping-page URLs with wallet and user identifiers to Bring Web3.

stopRU sends visited YouTube page URLs and detected video/channel details to Mixpanel analytics.

SellerSprite collects Amazon product listings, seller details, keyword rankings, and review data from users' sessions and transmits them to its own servers.

Video Download injects a hidden iframe to div.show on every page, plus a time-delayed variant that activates 8+ hours after install.

Easy Video Downloader fetches a native client binary from GitHub and optionally passes tab cookies to a local native messaging process.

cat-catch intercepts all browser network requests to detect and capture media URLs (video, audio, M3U8, and MPD streams).

Copyfish routes images through a public CORS proxy and sends tab screenshots to a third-party OCR service via a hardcoded shared API key.

Media Converter and Muxer downloads FFmpeg from GitHub without verifying file integrity before installing it to the user's home directory.

AudD Music Recognition sends tab URL, page title, and a persistent device ID to api.audd.io on every song recognition request.

AutoSBC sends FUT player inventory snapshots and market price data to its own servers, with upload behavior controlled by a remote config.

Speed Dial fetches a remote affiliate code on install, appends it to Yahoo searches, and screenshots bookmarked pages in hidden windows.

Bonjourr sends shortcut link origins, sync URLs, and custom background URLs to its own proxy service when direct requests fail.

Mino fetches coupon-testing scripts from api.gomino.com and runs them inside shopping pages it visits.

My IP Hider VPN transmits user account passwords in plaintext in URL query strings and stores them unencrypted in local extension storage.

Lightning Autofill fetches encrypted JavaScript from its servers and executes it on all pages for premium users.

XDM Browser Monitor collects cookies and request headers for intercepted downloads and sends them to the local XDM app via plaintext HTTP.

VPN Free Unlimited - VPNLY sends the user's real IP to a third-party server on every startup and bundles hardcoded proxy credentials.

Eagle includes a payment plugin that selects a payment method and auto-submits forms on Taiwanese payment gateway pages.

Reverso sends the current page URL, page title, and a persistent device UUID to its servers with every translation query.

PureVPN Proxy sends user email, account ID, device UUID, OS, and VPN session details to its analytics endpoint on every user action.

2! Authenticator stores TOTP account secrets as reversible base64 JSON unless the user enables a password.

3D Street View sets 3dstreetview.com as the browser's default search provider and sends address-bar searches there.

AMALYZE sends hashed Chrome profile email, profile ID, and an extension UUID to falcon.amalyze.com during heartbeats.

API Tester - REST Client Testing Tool acts as a remote-controlled HTTP proxy and sends fetched response data to api.asotools.io.

Advanced Notepad backs up saved notes to JSONBin with hardcoded keys that can read backups by ID.

AiPrice(AliPrice) sends page URLs, titles, and referrers from all HTTP and HTTPS pages to analytics endpoints.

Ali Invoice can disable selected installed extensions based on a remote compatibility list.

AliExpert Shopping Assistant opens remote-configured affiliate redirects in hidden tabs on AliExpress product pages.

AliCompare opens a hidden AliExpress affiliate redirect tab when you reach checkout.

AliSave sends merchant page URLs to alisave.info and can apply server-supplied redirects.

Aliexpress Dropshipping sends product and order data to the store API URL configured by the user.

Always Secured powered by Yahoo redirects Google and Bing search-result visits to alwayssecuredsearch.com with the query preserved.

Amazon Quick View by EarData sends Amazon Seller Central and retail page URLs and page HTML to EarData's API.

Amazon Search Pro routes address-bar, popup, omnibox, and selected-text searches through chromecrxstore.com.

Art New tabs sends new-tab search terms to goog.artnewtabs.com.

AsinSeed sends an MD5-derived password value in the sign-in URL query string to www.asinseed.com.

AuctionGate uploads your Manheim session cookies and auction visit data, including IP and location, to auctiongate.io.

Authenticator App forwards autofill requests for credential fields to a localhost WebSocket using bundled AES key material.

BestWallpaper NewTab Extension sends new-tab search queries to best.bestwpnew-tab.com with a fixed affiliate tracking ID.

Beyond Meet for Google Meet returns its Google Drive OAuth access token to scripts running on meet.google.com.

BitLy sends each shortened URL to Bitly and a plaintext n8n webhook.

Block Site Ex requests all-sites access and browser network-rule permissions to block configured websites.

Bookmark Drag and Drop sends new-tab search terms to search.bookmark-folders.com with a fixed tracking token.

Bounce off the Wall sends new-tab search queries to ehereugo.com with fixed partner identifiers.

ClickUp BrainMax sends the user's real IP address, country, OS, and a device UUID to the Singular attribution SDK on install and on each login.

BuxMoney follows remote tasks that navigate, click, scroll, play media, and inject scripts in its autosurf window.

Casper Wallet sends visited merchant URLs and the active wallet public key to api.bringweb3.io for its BringWeb3 integration.

Chat Plus sends selected Google Chat messages to its backend and uploads recorder media to Google Drive.

ChatGPT Extension uploads user-selected image attachments to ImageBB before sending them to ChatGPT.

This extension lets users view, organize, enable, and disable installed Chrome extensions.

CiteMaker CiteWeb sends login passwords in GET requests to citemaker.com during popup sign-in.

Cityscapes sends each Chrome top-sites URL to Google's favicon service when it renders the new-tab page.