Medium risk browser extensions

Ultimate Basketball Fan Extension sends new-tab search queries to search.basketball-fan.com with a tracking ID.

Up Assistant uses remote rules to redirect matched pages and log the original and redirect URLs to ali-stat.info.

VK AD SKIP sends VK video viewing details and account identifiers to vkadskip-api.star-tech.dev.

VPNtube sends selected proxy credentials to any site that asks for HTTP authentication while its VPN is enabled.

Video Downloader Pro sets chromeapps.site as the default search provider for omnibox searches.

Video Recorder exposes camera and microphone device inventory to any page that embeds its permissions screen.

Viral Vue sends supported-site page URLs to api-iris.viralvue.com during session checks.

Voicenter Contact Center stores Voicenter IDs and call-status data in the active website's localStorage when its strip panel opens.

Voicy uploads user-triggered microphone recordings with the current site hostname to its transcription API.

WA Bulk Message Sender Extension sends WhatsApp Web telemetry to Google Analytics and message-preview URLs to preview servers.

WA Group Number Exporter sends your WhatsApp account phone number in telemetry to Alibaba Cloud SLS.

WA Message Sending Bot sends WhatsApp page analytics and a persistent client ID to Google Analytics.

WADirect Message sends links in WhatsApp messages to third-party link-preview services before delivery.

WAPI PREMIUM - Jaguar imports remote code into WhatsApp and stores WAPI login credentials in page localStorage.

WAPremium MultiWeb stores its ChatCenter bearer token in WhatsApp Web localStorage.

Watch TV sends new-tab search terms to watchtvonline.org as users type.

Web Search redirects default searches with a persistent extension GUID to search.websearchextension-api.info.

Weblio エクステンション sends selected page text to api.weblio.jp in an embedded quote iframe.

Website Ranking and SEO Checker by Semalt sends each visited hostname to Semalt ranking and request-log APIs.

World Clock Tab sends new-tab search queries to sthecfone.com with affiliate/source identifiers.

YouTube Text Tools sends the current YouTube URL, video ID, and stored client/session IDs to its analytics server.

Youtube Playlist Exporter sends a Parse session token to api.letsfaster.com when opening its subscription payment page.

Zecento: Droplist con AI follows remote commands that crawl webpages in hidden frames and send URLs and page content to Zecento.

Zen tab sends your Chrome top-sites URLs to zen-tab.com for Most Visited thumbnails.

iGive Button sends visited site URLs and merchant-page activity to PostHog when its tracking rules match.

impact.com for Chrome sends visited domains to impact.com when publisher-mode affiliation checks run.

unFunnelizer sends video download and conversion page URLs to Google Analytics and its backend.

xMetaCene sends your Twitter/X cookie and engagement activity to x.metacene.io.

AvToolsPro polls av-tools.pro for operations that can fetch Avito pages with your browser credentials.

Recipio routes all search queries through Yahoo affiliate search with hardcoded partner tracking codes, without disclosing this to users.

Twitch Ad Blocker fetches remote rules that can redirect pages, open affiliate tabs, and click page elements.

Ads Trust reads Facebook Ads access tokens from business pages and stores them for display in its popup.

AliExpress - Search by Image checks visited hostnames with chat-secreto.es and redirects some pages with the full URL.

Aliexpress Free invoice - AliInvoice rewrites AliExpress shopping pages through an affiliate redirect.

Amazon Review Request Tool ASINsell sends scraped Amazon review profiles and review content to api.asinsell.com.

Black Friday de Verdade sends matched checkout-page URLs and extracted page values to its backend.

Calendar View Tab sends new-tab search terms to Yahoo with fixed tracking parameters.

Canned Responses Pro for Jira starts LogRocket session replay on Jira pages and sends Atlassian account and license metadata.

Coupert Guard lets any website change its ad-blocking settings through a page-accessible message bridge.

Economize! Mundo Conectado extracts shopping-page values and sends them to its vendor backend.

Eye Saver Tab sends new-tab search queries to eyesavertab-com.s1search.co.

FastApply sends page error telemetry from most pages where its content script runs to its API.

GeoEdge sends account usernames and passwords in tools-api.geoedge.com URL paths during login and user-agent refresh.

Get Movies Info sends searches typed on its new-tab page to r.bsc.sien.com with affiliate parameters.

Google Search Console & Bing Webmaster Tools sends submitted URLs and indexing results to Mixpanel analytics.

Hackertab starts Sentry Replay in its new-tab UI with unmasked text and media and default PII enabled.

Holmes sends unmatched bookmark-search text to Google Search over cleartext HTTP.