Medium risk browser extensions

Comment Stack records its extension UI pages and sends DOM snapshots and input events to tglens.tabgraf.com.

Etsy Downloader sends Etsy page URLs and search terms to Aliyun Logs when download controls are used.

ExtraPe - Affiliate Link Converter sends account passwords in authentication URL query strings to www.extrape.com.

FIVERR + sends Chrome profile and Fiverr account details to fiverr-plus.vercel.app on install and startup.

Filestage removes framing protection headers from all subframe responses after detecting its viewer.

Fotor Design opens selected page image URLs on Fotor over plaintext HTTP.

Gemini EDU Prompt Assistant (TW) stores your Gemini API key in gemini.google.com localStorage and sends it to Google's API.

Get Maps & Driving Directions sets bestfreemaps.com as the default search provider for omnibox searches.

HBO Max Dual Subtitles sends subtitle text, tab details, runtime messages, and storage changes to Amplitude.

Minimalist Tab routes browser and new-tab search queries through ad-block-pro.co and track.clickcrystal.com.

Moni sends the user's bearer access token in its trading WebSocket URL.

Ntro.io can send interview-page screenshots and transcript text to api.ntro.io after remote websocket commands.

OUI9 HLS PLAYER M3U8 lets web pages drive tab-level request header changes through its public player page.

PERRLA stores the user's account password in local browser extension storage after login.

Random wallpaper sends typed new-tab search queries to suggest.findit-all.com for suggestions.

SEO Toolkit contains a remote-controlled redirect mechanism that can send the browser to a third-party URL before a page loads.

Search by image on Aliexpress sends visited URLs to apiheaven.io and can redirect tabs through apiheaven.io/pulse.

SkoleGPT Webudvidelse reads DOM text and screenshots from every active tab and transmits them to llm.dbc.dk using hardcoded API keys.

Technion Plus Plus embeds GitHub API tokens and uses them to upload shared course histogram data to GitHub.

The Optimiser asks a publisher-controlled endpoint for URLs and can open them in browser tabs each day.

WA Filter & Number Checker sends your Google profile email and WhatsApp number to its backend.

WB BHUMI PRINT stores Remember Me email and password credentials in extension storage for up to one year.

Zinx opens a first-login welcome page with the user's bearer token in the URL.

mdpi_home stores your MDPI login token in a non-secure cookie and renders notifications into active pages.

The extension sends selected page text to Youdao's HTTP translation endpoint for lookup.

WhatRuns reads page HTML, email addresses, and server-selected page fields and sends them to whatruns.com.

Utorrent For Firefox sends uTorrent Web UI credentials and torrent URLs over cleartext HTTP.

2FA Authenticator stores authenticator secrets and bypass credentials encrypted with passphrases shipped in the extension.

AI Translator sends text you ask it to translate to OpenAI with a bundled API credential.

AIPrompter saves AI prompt history in each supported site's localStorage.

Ambition watches non-password form fields and sends captured values to api.remoteambition.com.

ArchiveBox sends API keys and saved page URLs to user-configured ArchiveBox servers without requiring HTTPS.

Asin Gadget posts Amazon dangerous-goods ASIN matches to a Google Apps Script endpoint.

Baba Image Downloader redirects AliExpress and Alibaba product pages through rzekl.com affiliate links.

B站bilibil弹幕下载生成ASS字幕 can send downloaded Bilibili danmaku and video metadata to a server-supplied URL.

Canvas Hack hides focus and visibility changes from every HTTP(S) page after paid activation.

ChatSearch: ChatGPT for Search Engine (GPT4) logs search prompts with IP-derived fields and a UUID to Alibaba Cloud.

ComedyTab sends new-tab search queries and partner identifiers to find.wsrc-now.com.

Competition Meter sends product images to Google Cloud Vision when users click its Inspect Product button.

Daily Planner sends your profile email, location, IP lookup data, screen size, and planner state to an AWS API.

Discord Instant Translation sends Discord chat text to its translation API over HTTP.

DontBugMe sends the active site's hostname to analytics and queries BugMeNot for shared credentials.

Download YouTube Transcript sends YouTube transcripts, video metadata, and activity events to ytranscript.app and Amplitude.

Dual Page Sync removes frame-embedding protections from sites opened in its split-tab view.

E-commerce Side-to-side to AI sends user-added product details and comparison links to its backend.

ELMessenger Pro reads Facebook friend birthdays and sends the records to next.cloudki.io every 30 minutes.

Easy Shop sends top browser history URLs to easyshopsoffers.com and reports visits matching server-chosen URL keywords.

Email Generator renders remote email HTML from emailgenerator.24maxkazakov.ru inside an unsandboxed popup iframe.

FREE Twitter (X) Social Data Scraper sends scraped X posts, news, trends, and account details to Supabase.

Flipkart Image Downloader opens a background affiliate tab to sovrn.co when users download images.

Form Saver saves form values, including password and hidden fields, into the active page's localStorage.

GITHUBER - New Tab sends bookmark logo upload tokens and selected images over cleartext HTTP.

Get Screen Resolution sends new-tab search queries and typed URLs to yhereugo.com with affiliate identifiers.

Goodreads Right Click sends selected page text to Goodreads as a plaintext HTTP search query.

Homely can fetch your eBay cart page over cleartext HTTP for its optional basket widget.

JoggAI uploads the active page's full HTML and URL after you click Convert.

KDP Autofill sends license validation requests to autofill.mercherworld.com with embedded WooCommerce API credentials.

Libgen search sends popup search terms to selected Libgen proxy sites over HTTP.