Medium risk browser extensions

Cashback Assistant sends merchant-site visit events to Google Analytics with a persistent extension-generated client ID.

Chat AI opens a cleartext WebSocket that includes the signed-in Firebase user ID.

ChatGPT Prompt Assistant loads a Buy Me a Coffee image beacon on supported AI chat pages.

Cookie Editor lets a tumutuk.com paywall iframe enable an affiliate tag on Amazon product-page visits.

Cute Dogs Wallpaper sends new-tab search queries to cute-dogs-wallpaper-com.s1search.co.

Docs Offline sends pasted text, page details, quiz content, and page images from all sites to ClipKey servers.

GeoGuesser Hacker can capture the active tab in Fast/Max mode and send the screenshot to its Firebase backend.

Goldfire Highlighting allows any web page to collect cookies for arbitrary domains and forward them to a native host application.

Google Maps Extended Routes sends bookmark preview URLs to public CORS proxy services when direct fetching is blocked.

Google Search Console - Bulk URL Removal sends license validation requests to LemonSqueezy with a packaged bearer token.

Google Sheets Dark Mode runs delayed remote Google search tasks and sends browsing activity to refresh.simpledarkmode.com.

Instant Multi Search sends omnibox searches to Google Suggest over unencrypted HTTP.

Intentional sends extension analytics and blocked-page events with a persistent ID to PostHog.

KiotViet rewrites Facebook request headers and sends Messenger and GraphQL requests with scraped session tokens.

Learn Languages on YouTube & Netflix - zeroStudy sends watch-session details, an access token, and a bundled secret to Supabase.

Mailbutler for Gmail stores its API bearer token in Gmail page localStorage.

Music Downloader Premium sends each browsed page URL with a persistent user ID to www.runapps.org.

MyWorlClock sends new-tab search terms to clock.myworl-clock.com.

NIXZ Plugin stores remembered NIXZ account passwords in Chrome sync storage after login.

Offer.love uploads collected bank card-offer details to api.offer.love every six hours.

Page Analytics sends the current page URL to pageanalytics.io and writes click heatmap data into page-readable attributes.

PiHole Browser Extension sends the Pi-hole API password to its default Pi-hole HTTP admin endpoint.

Post SMTP Notifications sends the signed-in user's Firebase UID over a cleartext WebSocket.

Revzap contacts ads-blank.com for remote rules that update request blocking and page CSS changes.

Savely sends visited domains and, when eligible, full page URLs with a persistent ID to savely-plugin.vercel.app.

Segsmart Web Plus rewrites WhatsApp Web's security policy and places login tokens in its uninstall URL.

Tab Merge sends all complete current-window tab URLs to the first tab's origin when you click its toolbar button.

Telegram Video Downloader sends Telegram chat names to Google Analytics when users download videos.

Telegram Video Downloader sends signed-in profile details to the web page that opened its auth page.

Tetrycs loads remote analytics scripts and inserts remote advertisement HTML in its popup.

TikTok unban - ban pass fetches remote rules that can rewrite visited tab URLs to server-supplied destinations.

Tiplino reads selected page text chosen by remote rules and sends it to www.tiplino.hu.

Udio AI Music Generator reads your Chrome profile ID and sends it to livepolls.app for extension login.

UpAlerts: AI Cover Letters exposes its account email to scripts on Upwork, Fiverr, and LinkedIn through a page event bridge.

Web browser with anonymous access sends each non-OffiDocs tab URL to OffiDocs with a persistent local username.

World Weather redirects new-tab search queries to search.world-weather-extension.com with a fixed tracking ID.

Writer Watch embeds a WordPress API authorization key and sends user and book IDs to writerwatch.com.

iTour chat translation sends page text for translation to a cleartext HTTP endpoint.

leetcode cheatsheet sends problem page HTML, URL, title, language, and editor code to RapidAPI when you click write solution.

X-notifier uses plain HTTP for some optional forum and mail checker requests, including credentials or mailbox data.

Browse.live Web Safety can collect page DOM text or attributes from any site and send them as telemetry.

AboveVTT loads Dropbox and YouTube scripts into authenticated D&D Beyond VTT pages.

PAYBACK Internet Assistent includes PAYBACK API credentials and uses them for CAPI requests.

AdBlocker Diamond can load server-selected scripts into matching web pages.

Save Facebook Ads & Reveal Ad Spend - Adscan.ai reads and writes Facebook ad reach cache entries on Upstash.

AliExpress CSV Export redirects AliExpress product and store clicks through clickwrap.xyz once per day.

AliSaving Plus opens AliExpress product and store clicks through a hardcoded affiliate deep-link URL.

Amazon Vine Ultraviner downloads code from ultraviner.com and registers it to run on Amazon Vine pages.

Architecture Tab sends new-tab search queries to srchingoz.com with affiliate parameters.

AutoGrok sends the signed-in Grok account email to Google Analytics and uploads selected image-reference files to imgbb.

Automatic twitch translator sends Twitch chat text to translation providers and loads remote selector config.

BestStore Printer Launcher exposes an unvalidated HTTP proxy via its external messaging API, reachable by any localhost page.

Bitcashback uploads stored popup interaction logs with active-tab domains and the logged-in email to bitcashback.net.

Brawl Stars Cursors redirects Google search pages to ugnewtab.net with the user's query.

Calligra online - office, graphics & email sends visited page URLs to OffiDocs with a persistent extension-generated username.

Cashback service Paidwork can send its stored Paidwork user ID to a page-controlled URL after a click.

Check US Visa Slots sends AIS appointment details and an appointment-form screenshot to app.checkvisaslots.com.

CiteMaker CiteWeb sends login credentials to citemaker.com using GET requests.