Medium risk browser extensions

YouTube AdSkipper sends the signed-in Chrome profile ID and ad-skip counter to api.markgurney.dev.

chatgpt for google: search gpt removes ChatGPT's CSP and uses remote rules to hide page elements.

xdata sends selected X tweet content and engagement details to xdata.din.lol.

Много.ру inserts your stored loyalty card number into remote-selected partner pages.

サテライトAI・プラグイン sends completed AI chat prompts and answers to gptapi.sateraitoai.jp.

RoQoL sends Roblox play status, game identifiers, and friend activity to roqol.io.

Affinity Pathfinder embeds each visited site's domain in an extension iframe URL that sampled Datadog RUM events can send off-device.

AliDown rewrites AliExpress product and store clicks through an AliExpress affiliate deep-link endpoint.

AliExpress: Search similar products reroutes AliExpress item clicks through the shopnow.pub affiliate tracker.

Audio File to Text Converter sends selected audio files to Lemonfox for transcription.

Auto Login stores saved login form credentials with a hardcoded AES-CTR key included in the extension source.

BeFunky Extension injects stored screenshot or selected-image data into every completed tab.

BestSuggest sends page titles, URLs, headings, and meta keywords to its recommendations API on each completed page load.

Black List Site 2 records full page URLs, page titles, visit counts, and time spent for sites you visit.

BooleanAssistant runs SalesABC tasks that read LinkedIn pages and API responses, then send the results to SalesABC.

CR7 Wallpaper HD HomePage sends new-tab search text to Google Analytics as user-search telemetry.

Change Default Search Engine routes browser search terms through default-search.site and sends ad events with a persistent client ID.

The extension sends YouTube Music track details to artwork.boidu.dev when animated art is enabled.

Consenter Einwilligungsagent exposes its stored consent settings to scripts on any website through a message bridge.

Cristiano Ronaldo (CR7) MeaVana sends public IP addresses and Urban Dictionary searches to third-party APIs over HTTP.

Dyslexic Browser sends its stored client ID to db.foureyedjimmy.com over plaintext HTTP for subscription checks.

Emparator E-ticaret Urun Analiz Programi sends the user's Emparator password in a login URL.

FC 26 Sniping Bot lets EA's web app read extension local-storage keys, including a saved login response.

Fortect Browsing Protection sends your browser history, installed extensions, and Google account email to Fortect servers.

Free VPN for Chrome - GoVPN routes browser traffic through a hardcoded HTTP proxy while showing a 256-bit encryption status.

Good Gantt stores its backend bearer token in Trello page localStorage after authenticating with its API.

Helper Tools for ASOS fetches affiliate settings from getrates.su and appends them to clicked ASOS links by default.

Kontos has no confirmed data-sharing findings in the reviewed scan.

Minecraft Wallpaper sends Chrome top-sites URLs to Google's favicon service on each new-tab page.

Movie Stream Tab sends your Chrome top-sites URLs to Google's favicon service on its new-tab page.

Nature Theme Tab sends new-tab search terms to Amplitude before running the Chrome search.

Neuralwriter sends matching-page HTML snapshots and hidden provider tokens to research.neuralwriter.com.

New Tab Weather sends new-tab search terms and campaign identifiers to vmnapi.net.

OCR Text Recognition injects coupon HTML from api.pictureknow.com into Taobao, Tmall, and JD product pages.

Oink for Influencers mirrors saved API keys and account identifiers into page localStorage on Amazon-related pages.

One-Click Translate Selection opens Google Translate with the page text you choose from the context menu.

Online Subtitles renders locally selected subtitle text as HTML on every matched video page.

Open IE bundles an unsigned Windows executable and downloads it to the user's machine without any integrity verification.

Premium Sender - Rocket Sender for WhatsApp sends WhatsApp page telemetry and link-preview URLs to external services.

ProtectedSearch.io redirects Google and Bing search navigations to protectedsearchesio.com with the original query.

Rex KeepAlive sends encrypted session heartbeat reports with IP address, geolocation, and device fingerprint to Rex.

RoPro Gold replaces Roblox purchase controls with RoEarn buttons that open roearn.io.

Save ChatGPT to Notion sends failed Notion-save payloads and user identifiers to chatgpt2notion telemetry.

TexAu v2 accepts remote PAC scripts that can route broader browsing traffic through configured proxies.

UpSearches sends search-event telemetry with persistent identifiers to webinline-usage.streamesh.net.

View Menu with Prices makes viewmenuprices.com the default search provider and sends omnibox queries there.

Web Collector for MAXQDA fetches page-provided image URLs with extension privileges and writes the image data back into the page.

Winter Snow Wallpaper sends most-visited site URLs to Google's favicon service on the new-tab page.

Zombie new tab sends searches and typed URLs from its new-tab box to spaceship-newtab.com.

gbfdrop stores the user's account password in plaintext browser extension storage.

we advocacy notification chrome extension sends Gmail recipient and subject metadata when a campaign signature is used.

The extension sends visited site hostnames from browser tabs to rdtds.net when remote config enables tracking.

The extension removes Claude's malicious-prompt caution banner on claude.ai pages.

Karma navigates inactive Facebook profile tabs to read a birth year and send it to www.karmanow.com.

VPN Free - Betternet VPN Proxy runs remote-configured coupon automation on merchant pages.

Google Traduction sends selected text from any website to softnour.com for translation.

DesignHub sends typed omnibox search terms to suggesting.designhubapp.com over unencrypted HTTP.

ASO - Toolbox by StoreMaven sends profile email and store-page analytics to StoreMaven's App Engine endpoint.