Medium risk browser extensions

LinkSnappy Elite sends login credentials in the LinkSnappy authentication URL and loads torrents over HTTP.

Little Bee sends click telemetry with page URL, referrer, screen size, and an ID to extanl.jtcrpa.com.

M3U IPTV sends playlist URLs to m3u-ip.tv over HTTP and lets that site read cross-origin responses.

Marter sends Download Buy List CSV exports to a hardcoded Google Apps Script endpoint.

Mega-Debrid Browser Extension sends login credentials to www.mega-debrid.eu/api.php as URL query parameters.

NotBlockNet VPN returns its proxy token to every HTTP authentication challenge.

OpenL Translate sends translation requests to api.openl.io with hardcoded API secrets bundled in the extension.

PromptFolder stores your account password and login tokens in Chrome local storage after you sign in.

SaleFlow captures Wildberries seller details and sends remotely requested search results to SaleFlow servers.

Save Website as PDF sends Google Analytics events when users generate PDFs and interact with the popup.

Security-Header-Extension sends the active tab URL and security response headers to 129.82.174.202.

SellerAider Toolkit sends Depop page URLs, page HTML, and usage/error telemetry to Discord and SellerAider endpoints.

SherpaDesk loads its mobile login over HTTP and stores returned account token values in local browser storage.

Similar Inc | Shopping Comparison Co-Pilot sends a persistent user ID and non-product page URLs to Similar Inc.

Stat Vin sends Manheim cookies and auction-site login/page activity to AuctionGate.

Strong Password Generator creates passwords with Math.random instead of a cryptographic random source.

Tabee: Tab Modifier displays open-tab and bookmark search results in page-readable overlays on every site.

Tally Tab sends searches typed on its new-tab page to r.bsc.sien.com with affiliate tracking parameters.

TanglePay IOTA Wallet lets connected websites request its stored API login token.

TasteWP sends detected WordPress plugin slugs to plugins.svn.wordpress.org when its popup enriches results.

Textverified lets Textverified web pages, including HTTP pages, change proxy settings and read extension storage.

Tomo Wallet embeds static backend authorization credentials for its Bitcoin RPC and BRC20 API requests.

Translate Web Page stores translated page text, page titles, and URLs in site-readable localStorage.

TransorAI includes hardcoded credentials for OCR, Microsoft Translator, and Zhipu AI services.

Wallpapers - New Tab sends searches from its new-tab page to khereugo.com with affiliate parameters.

The extension sends the Wildberries WILDAUTHNEW_V3 session cookie to external.alteit.ru.

Wistia Video Downloader sends download telemetry, including page URLs and video IDs, to caverdant.online.

Zillow Redfin Realtor Real Estate Supercharge injects Inspectlet tracking code into Redfin, Zillow, and Realtor pages.

ZoomSelling forwards a seller Uzum access token from ad campaign pages to its backend.

有道词典右键查询 sends selected text from its context-menu lookup to dict.youdao.com over HTTP.

词匠-AMZ海量关键词运营 embeds a default CiJiang API signing token used to sign requests to api.cijiang.net.

Youtube Defender routes YouTube and GoogleVideo traffic through hardcoded authenticated SOCKS proxies.

Check4Change sends monitored page URLs and selected page text to check4change.com for VIP email alerts over HTTP.

Image Downloader rewrites outgoing request Referer headers to the active tab's origin while its popup scans a page.

Claude Usage Tracker stores Claude prompt and request details in local debug logs whenever it runs.

SkipIt Adblocker for Youtube can send current page URLs to endpoints chosen by remote configuration.

Tipli runs on all websites, reads page text with server-supplied selectors, and sends it with the page URL to Tipli.

Pop2Watch scans visited pages for remote patterns and sends page URLs, titles, and matched links to api.pop2watch.com.

Instant Data Scraper reboot can load jQuery from code.jquery.com into the active tab when bundled injection fails.

Ghelper disables other enabled browser extensions that request proxy access.

CDA Downloader opens short.ovh tabs during most CDA.pl link clicks and some download clicks.

AMA Interview AI sends selected text and page URLs to amainterview.ai, then renders API-provided HTML into pages.

Abstract Art Tab sends searches from its new-tab page to find.asrcnav.com with affiliate parameters.

Advanced Download Manager ADM links its required desktop installer over cleartext HTTP.

Advigator scrapes Amazon seller contact and storefront details and sends them to Advigator.

Agent for WeChat sends GPT reply events, including WeChat prompt and reply fields, to PostHog when analytics is configured.

Ali Assist redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliDownloader Plus redirects one AliExpress link click per day through clickwrap.xyz in a background tab.

Amazon Book List Downloader sends the full license key to Google Analytics after successful licensed exports.

ArqSign Certificado Digital lets HTTP-scoped vendor pages send signing requests to its native bridge.

Automate Bing Searches Rewards sends default and automated search queries to howtodowork.com.

Blackfy fetches a Google Sheets affiliate map and redirects matching visited domains to configured affiliate URLs.

BookMiner sends embedded Keepa and DataForSEO API credentials to third-party APIs during Amazon research features.

Bookmarker for YouTube loads saved video thumbnails over cleartext HTTP from YouTube's image server.

CallHippo-Virtual Phone System lets any webpage open its dialer popup for a chosen phone number.

Canopy GUI Enhancer sends hovered MAC addresses from Cambium admin pages to maclookup.info as executable JSONP.

Cats & Kittens Wallpapers sends new-tab search terms to search.cats-wallpaper.com.

CiteMaker CiteWeb sends login credentials to citemaker.com using GET requests.

Color Picker for Chrome captures the visible tab and inserts the screenshot into the active page as a readable canvas.