Medium risk browser extensions

Claap removes Bubbles and Loom companion widgets from productivity sites where its content script runs.

Comunidade ZDG FREE fetches and eval-executes a GitHub script inside WhatsApp Web after WhatsApp tabs load.

Cookie Guard writes detected affiliate cookie details into page-visible alerts and sessionStorage.

Cool Cursors redirects Google search pages to ugnewtab.net with the user's original search query.

Copilot for Gmail by cloudHQ sends Gmail account lists and visible message contacts to cloudHQ for checks and CRM lookup.

Coupons Search sets searchext.com as your default search engine, routing every address-bar query through a Yahoo-syndication redirect.

Currency Helper sends searches from its new-tab page to goog.currencyhelperext.com.

DashBlox fetches privacy-policy Markdown from GitHub and injects the converted HTML into its Roblox settings page.

DealsUpp - Contact Saver for WA injects a WhatsApp helper that sends page and session telemetry to Google Analytics.

Dictionary, Thesaurus & Reference opens selected or typed lookup terms in cleartext dictionary URLs.

Discord VPN routes Discord and non-Discord account and payment domains through extension-configured proxy servers.

Docs Offline sends pasted text, page details, quiz content, and page images from all sites to ClipKey servers.

Download Aliexpress Product Images & Videos rewrites AliExpress shopping pages through an affiliate deep-link endpoint.

Downloader for Microsoft Text-to-Speech sends synthesize and account telemetry to Amplitude.

Dragon Wallpaper sends up to 10 Chrome top-site URLs to Google's favicon service on its new-tab page.

Drop Tab sends weather location lookups to geoiplookup.io and droptab.net, and adds install IDs to new-tab searches.

DualPiP exposes a cross-extension fetch proxy that can send requested URLs, headers, and page content to any installed extension.

The extension sends Wildberries seller profile and supplier contact data to Eggheads.

ESUIT Mass Friends Remover for Facebook exposes stored ESUIT profile and subscription data to Facebook-scoped pages.

Easy Login sends Gamer.com.tw page-load hostnames to Google Analytics with a persistent client ID.

Email Privacy Protector sends your Gmail address and locale details to cloudHQ during Gmail sessions.

This extension enables right-clicking, text copying, and full context menus on restricted websites.

Explore Beach sends new-tab search queries to searchtsm.com with an affiliate campaign parameter.

Fabasoft Folio 2020 relays cookies from any visited page to the local Fabasoft native host when a first-caller web page opens the messaging channel.

FashionReps Link Converter rewrites shopping and registration pages to URLs with hardcoded referral codes.

Findy reads your LinkedIn session cookies and auth headers and sends them to Reply.io to operate LinkedIn on your behalf.

Flash Player Extension For Web sends page URLs and device/IP details to an Aliyun log endpoint.

FlashSale AutoBuy sends shopping product URLs and popup tab details with stored location fields to buydekhke.com and unscart.com.

Flow Wallet stores Google Drive wallet backups with an encryption key shipped in the extension bundle.

Formatted Email Subject Lines by cloudHQ sends your Gmail address and extension metadata to cloudHQ on Gmail load.

GHL Cloner sends a persistent client ID and public IP address to Google Analytics on startup and hourly alarms.

Games Search recreates its vendor-domain ID and user-agent cookies after they are deleted.

Get Catapult sends new-tab search queries to newsubmission-com.s1search.co over cleartext HTTP.

GetSystemMonitor sends new-tab search terms to nthecfone.com with fixed campaign identifiers.

Gmail Snippets sends every signed-in Google account email to cloudHQ's servers each time Gmail loads.

Goku Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

HBO Max HQ collects viewing history, account PII, and subscription data and transmits them to third-party servers under remote command.

This extension enables printing from Chrome or a Chromebook through HP Secure Print.

HP Support Assistant for ChromeOS lets HP's support site request ChromeOS serial, hardware telemetry, and diagnostics.

HeyMax: Stack Miles & Rewards sends extension analytics events to Customer.io using credentials bundled in its content script.

Homer sends real-estate listing pages, search URLs, listing IDs, and page-view analytics to its APIs.

IRCTC TatkalMate stores IRCTC login and payment fields in local browser storage encrypted with a hardcoded key.

InFormEnter+ generates profile passwords with Math.random instead of a cryptographic random source.

IG Comment Export Tool sends Instagram comment API responses and export settings to Alibaba Cloud SLS.

Instagram Video Photo Download - IG Downloader forwards Instagram API responses to a hardcoded extension ID.