Medium risk browser extensions

Integral CertHandler relays unvalidated CustomEvent commands from any web page to a native certificate-handling app.

International Jobs by Leapfrog scrapes LinkedIn page details with server-provided selectors and sends them to Leapfrog's backend.

JDM Cars Wallpaper New Tab sends new-tab search queries to tabssearch.com.

LeetCode Timer sends LeetCode submission code and timing details to codelytics.app after submission checks.

Leetify for Codeforces accepts a login session token from any page loaded on localhost:3000, not just its own site.

Live Transcript Extension includes hardcoded Symbl.ai credentials used to request speech API tokens.

Lyrics ( Youtube / Youtube Music ) inserts lyrics.co.kr responses as HTML into YouTube pages.

M3U8 Downloader fetches and merges HLS video segments from user-supplied URLs and saves them locally as .ts or .mp4 files.

MCP SuperAssistant sends page URLs, titles, environment details, and a persistent client ID to Google Analytics.

MailKing sends your Gmail address, open thread IDs and other signed-in Gmail accounts to cloudHQ.

Mailinblack lets any website set its trusted service URL before the first legitimate connection.

Malware & URL Scanner sends scanned URLs and domains to multiple reputation APIs, including several over HTTP.

MetricMaster sends searches typed on its new tab page to meter.metermaster-ext.com with a fixed tracking ID.

Microsoft Bing InPrivate sends a persistent machine ID and browser details to g.ceipmsn.com over HTTP.

MillionPugs disables installed ad blockers during its cashback redirect flows.

My Fpoly Extension disables development extensions and a fixed extension ID from pages on poly.edu.vn.

My Online Learning Downloader sends the page user object and current URL to its telemetry API when downloads start.

MyCoub loads a remote stylesheet on Coub pages and can send captured video frames to Yandex Images.

MyToDo sends new-tab search queries to goog.mylistodo.com with a fixed tracking ID.

Nature Extension sends precise geolocation to OpenWeatherMap and top-site hostnames to Google's favicon service.

NeoLine lets any web page request the selected Neo N3 wallet address and token balances.

New Tab Search Assistant 52 sends new-tab searches over cleartext HTTP to mybrowserbar.com.

Neymar - Football Live Wallpaper sends saved shortcut URLs to Google's favicon service when its new tab page opens.

Node Inspector Manager sends Chrome profile identity and debugger session details to analytics services.

OKIOCAM Time-Lapse makes uploaded webcam time-lapse files readable to anyone with the Google Drive link.

CROSSx lets any HTTPS page switch the wallet's active chain through its injected page bridge.

Official Card Counter Trello with Totalizer redirects visits to shopping sites through affiliate links.

Offline QR Code Generator sends the active tab URL to QR-shortener endpoints when making a code by default.

Oink for Influencers mirrors saved API keys and account identifiers into page localStorage on Amazon-related pages.

Online AntiVirus Protection sends visited page URLs and referrers to analytics.chromeapps.site with a persistent UUID.

Online Search sends typed new-tab search terms to onlinesearchtool.org for suggestions and search.

Open Two-Factor Authenticator stores TOTP secrets in sync storage using password-hash AES encryption.

Overprice sends page URLs to overprice.app and can return server-directed page content extractions.

Page Load Stats fetches remote rules that can inject chosen scripts into matching visited sites.

Password Generator sends new-tab search or URL input to isrcfornow.com with affiliate parameters.

Personalized Backgrounds sends new-tab search queries to goog.personalizedbackground.com.

Photo Editor loads HTML from linangdata.com into its popup and opens links the server supplies.

Pianoic replaces the new tab with a search box that sends entered searches or URLs to rsrc2u.com.

Pixdownify Image Downloader sends hourly Google Analytics heartbeat events with a persistent extension client ID.

Play to Kodi sends Kodi JSON-RPC credentials to the configured media server over HTTP.

Plus collects cookies from every third-party domain a captured page's resources come from, then uploads them with each snapshot.

Prime Connect - Message Sender sends WhatsApp phone-number and location analytics to Google Analytics.

Prime Party Extended [QVI] sends Amazon and Prime Video account details and remotely requested viewing data to its servers.

Privacy Extension for WhatsApp Web sends WhatsApp page telemetry and a persistent client ID to Google Analytics.

Product Image Downloader sends page URLs, user-agent details, and generated IDs to a hardcoded Slack webhook.

Progressive Shopper sends each HTTPS page's hostname to progressiveshopperapi.com when pages load.

Quick Engine Switch routes address-bar search terms through quickengineswitch.com.

QuizGPT sends Kahoot questions and answer choices to api.quizgpt.site and puts its bearer token in pricing-page URLs.

Random number generator redirects matching site visits through a bit.ly URL that appends the current page URL.