Medium risk browser extensions

Flash Player Extension For Web sends page URLs and device/IP details to an Aliyun log endpoint.

FlashSale AutoBuy sends shopping product URLs and popup tab details with stored location fields to buydekhke.com and unscart.com.

Flow Wallet stores Google Drive wallet backups with an encryption key shipped in the extension bundle.

Force.com LOGINS stores Salesforce account passwords in extension localStorage without protection by default.

GHL Cloner sends a persistent client ID and public IP address to Google Analytics on startup and hourly alarms.

Games Search recreates its vendor-domain ID and user-agent cookies after they are deleted.

Get Catapult sends new-tab search queries to newsubmission-com.s1search.co over cleartext HTTP.

GetSystemMonitor sends new-tab search terms to nthecfone.com with fixed campaign identifiers.

Goku Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

IRCTC TatkalMate stores IRCTC login and payment fields in local browser storage encrypted with a hardcoded key.

ITA Matrix Powertools sends clicked booking links and the current Matrix page URL to Skimresources by default.

InFormEnter+ generates profile passwords with Math.random instead of a cryptographic random source.

IG Comment Export Tool sends Instagram comment API responses and export settings to Alibaba Cloud SLS.

Instagram Video Photo Download - IG Downloader forwards Instagram API responses to a hardcoded extension ID.

International Jobs by Leapfrog scrapes LinkedIn page details with server-provided selectors and sends them to Leapfrog's backend.

JDM Cars Wallpaper New Tab sends new-tab search queries to tabssearch.com.

JoomPulse forwards intercepted Shopee marketplace API responses to joompulse.com.

LeetCode Timer sends LeetCode submission code and timing details to codelytics.app after submission checks.

Live Transcript Extension includes hardcoded Symbl.ai credentials used to request speech API tokens.

Livescratch lets Scratch pages request its stored LiveScratch bearer token through an external messaging bridge.

Lyrics ( Youtube / Youtube Music ) inserts lyrics.co.kr responses as HTML into YouTube pages.

M3U8 Downloader fetches and merges HLS video segments from user-supplied URLs and saves them locally as .ts or .mp4 files.

MCP SuperAssistant sends page URLs, titles, environment details, and a persistent client ID to Google Analytics.

Malware & URL Scanner sends scanned URLs and domains to multiple reputation APIs, including several over HTTP.

MetricMaster sends searches typed on its new tab page to meter.metermaster-ext.com with a fixed tracking ID.

Microsoft Bing InPrivate sends a persistent machine ID and browser details to g.ceipmsn.com over HTTP.

MillionPugs disables installed ad blockers during its cashback redirect flows.

My Fpoly Extension disables development extensions and a fixed extension ID from pages on poly.edu.vn.

My Online Learning Downloader sends the page user object and current URL to its telemetry API when downloads start.

MyCoub loads a remote stylesheet on Coub pages and can send captured video frames to Yandex Images.

MyToDo sends new-tab search queries to goog.mylistodo.com with a fixed tracking ID.

Naruto Wallpaper sends up to 10 top-site URLs from the new tab page to Google's favicon service.

Nature Extension sends precise geolocation to OpenWeatherMap and top-site hostnames to Google's favicon service.

NeoLine lets any web page request the selected Neo N3 wallet address and token balances.

New Tab Search Assistant 52 sends new-tab searches over cleartext HTTP to mybrowserbar.com.

Neymar - Football Live Wallpaper sends saved shortcut URLs to Google's favicon service when its new tab page opens.

Node Inspector Manager sends Chrome profile identity and debugger session details to analytics services.

OKIOCAM Time-Lapse makes uploaded webcam time-lapse files readable to anyone with the Google Drive link.

CROSSx lets any HTTPS page switch the wallet's active chain through its injected page bridge.

Official Card Counter Trello with Totalizer redirects visits to shopping sites through affiliate links.

Offline QR Code Generator sends the active tab URL to QR-shortener endpoints when making a code by default.

Online AntiVirus Protection sends visited page URLs and referrers to analytics.chromeapps.site with a persistent UUID.

Open Two-Factor Authenticator stores TOTP secrets in sync storage using password-hash AES encryption.