Medium risk browser extensions

AoneEnvRoute adds internal routing headers to all browser requests when certain environment profiles are active.

Archive.org Flip Book to PDF Downloader scans page images and canvas pixels from any active site when its popup runs.

Avo VPN provides a VPN-style popup and requests proxy access, with no confirmed external data recipients documented.

Cities HD Backgrounds in Your New Tab sends search-box queries to spntextension.com.

Corgi AI ships hardcoded Voicemaker and Google Analytics credentials in its extension bundle.

Demon Slayer Shinobu Kocho Wallpaper sends Chrome top-sites URLs to Google's favicon service on the new-tab page.

DesignHub sends omnibox suggestion queries to its suggestions server over cleartext HTTP.

Dog Cuties sends new-tab search queries to dogcuties.com before showing results.

Easy Driving Directions sends new-tab search box input to easydrivingdirections.com for autosuggest results.

Easy Slot Booking - USA (CGI) sends visa account details and appointment data to easyslotbooking.com.

EasyForm AutoFill stores saved form inputs by host and path, so HTTPS entries can be autofilled into matching HTTP pages.

FOP2 Extension sends password-derived authentication and click-to-call commands over cleartext WebSocket.

Faceit Stats by Eloking sends Steam profile lookups to FACEIT with a bundled API bearer token.

FindSCI retrieves a translator bearer token over HTTP before translating selected article text.

Dark Mode for Google Docs runs remote-controlled Google search tasks and reports visited URLs to its server.

Happy Wild Cats tags default search requests with a persistent session ID sent to happycatswild.com.

Hello Kitty Wallpaper New Tab sends your top-site URLs to Google's favicon service on the new-tab page.

INSTAVPN fetches remote configuration that controls its proxy servers and checkout API domain.

Image Downloader Pro sends install and update telemetry with the active tab URL, public IP, and a persistent UUID to Aliyun SLS.

Innfinergy v5.06 fetches remote Firebase settings that control automatic features on Innergy pages.

Kawaak ships a hardcoded Captain Data API key and project ID inside its extension bundle.

Kuromi Wallpaper sends top visited site URLs to Google's favicon service on the new-tab page.

Live Cricket Score Bar inserts score API responses as HTML into every visited page after a match is selected.

LunaNotes returns its stored bearer token to matched YouTube and localhost pages through external messaging.

MMZap sends WhatsApp Web account identifiers and incoming message content to GrowSoft and runs its API responses in the page.

Mailto: Set Default Email to Gmail by cloudHQ sends Gmail account addresses to www.cloudhq.net during its pre-user check.

Move It loads a CloudNouns image in each exercise reminder tab, sending the request to api.cloudnouns.com.

My Hero Academia Anime Wallpaper sends Chrome top-sites URLs to Google's favicon service on the new tab page.

Nature Wallpapers sends new-tab search queries to search.landscape-wallpaper.com with a hardcoded tracking ID.

NimbusMind sends passcode recovery emails and unlock codes to livestartpage.com over cleartext HTTP.

PDF to text lets its vocabulary.live iframe request the active page URL, title, selected text, DOM content, and localStorage.

PriApps Print Extension 2 sends print jobs and device details to the configured PriApps server over HTTP by default.

Quick Translate sends shopping cart and checkout page URLs to charitypartners.net after its donation prompt is clicked.

RSS Feed Generator for any site sends the active tab URL to Takeads when its popup opens.

Reminder captures copied and cut text from every website and stores it in local clipboard history.

Search AliExpress by Image redirects clicked AliExpress product links through searchbyimage.link.

Spotify VPN downloads remote proxy settings that can install a PAC script for browser traffic.

Stop Notifications sends default search suggestion terms to stopnotifications.com over HTTP.

SupportOn runs remote crawl jobs that collect page content, form values, screenshots, and request results from visited sites.

Surf Wallet embeds a live MoonPay signing secret and uses it to build checkout URLs for wallet addresses.

Thai Wallpaper sends new-tab search queries to goog.thai-wallpaper.com.

Twiclips sends Twitch clip and VOD URLs with a persistent user ID and IP-derived profile data to Alibaba Cloud logging.

Tự động download tải ảnh video trên shopee sends extension account passwords to software.hukata.vn in URL query parameters.

UchiHelper sends Uchi.ru access tokens and uid cookies to dz-helper.ru while automating exercises.

View Forms creates and restores a long-lived uid cookie for viewforms.org.

YouTube Unblocker routes YouTube-related traffic through freeruproxy.ink proxy servers.

eSnipe Snipe Tool fetches remote button settings and injects eBay buttons that send item URLs to eSnipe.

teleprompt AI sends scraped page email addresses and prompt text from supported AI/chat sites to Mixpanel.

Power Thesaurus sends the current site origin to its API and shares selected iframe text with embedding pages.

Form History Control saves non-password form entries from every site and can reuse single-line entries on other sites.

YouTube MP4 fetches remote rules that can inject an iframe into matching pages and pass it the full page URL.

Saladict can send selected page and form text to Baidu Translate over cleartext HTTP.

Alerta de ofertas e descontos injects a hidden whos.amung.us pixel and sends shopping page titles to descontosofertas.com.br.

Amazon Review Request Tool sends Seller Central query-performance reports to SellerApp.

Automatic message translator sends WhatsApp message text to translate-api.ext-api.com over HTTP.

BarnumPT fetches unpinned converter scripts from jsDelivr when importing FunnelWind HTML.

BlankADS sends browser and ruleset status to ads-blank.com and applies remote request-blocking and CSS rules.

Cars Wallpaper sends new-tab search terms to qsrcfornow.com with affiliate parameters.