Medium risk browser extensions

QR Code Reader loads its popup stylesheets from cdnjs.cloudflare.com and cdn.jsdelivr.net when the popup opens.

Quick Copy saves focused input values, including password fields, to synced extension storage when copy shortcuts run.

Save Emails to Dropbox by cloudHQ sends Gmail account-switcher email addresses to cloudHQ during its pre-user check.

Sell The Trend sends detected Shopify store hostnames and Facebook ad metadata to SellTheTrend services.

Squid VPN sends your public IP address to a hardcoded authorization server every minute.

ToDoNewTab sends new-tab searches or typed URLs with a fixed UID to vmnapi.net.

Treble.ai HubSpot Integration places the stored Treble API key in a page-visible HubSpot iframe URL.

VUBuddy runs JavaScript fetched from vubuddy.com inside education and course pages.

WA Quick Recruit sends WhatsApp Web page telemetry to Google Analytics and message links to link-preview servers.

WA Web Sender sends the user's WhatsApp phone number and location context to Google Analytics.

WAIX Extension injects WAIX scripts into marketplace pages and sends Taobao/Tmall item details to api.waix.ru.

WhatsApp Privacy Shield injects a Webholix promotional result into Google searches for marketing and web-development terms.

Word of the Day Tab sends new-tab search queries over cleartext HTTP to catloversbackgrounds-com.s1search.co.

YouTube AdSkipper sends the signed-in Chrome profile ID and ad-skip counter to api.markgurney.dev.

chatgpt for google: search gpt removes ChatGPT's CSP and uses remote rules to hide page elements.

eCards for Gmail sends your active Gmail address to cloudHQ's servers each time Gmail loads.

xdata sends selected X tweet content and engagement details to xdata.din.lol.

Много.ру inserts your stored loyalty card number into remote-selected partner pages.

サテライトAI・プラグイン sends completed AI chat prompts and answers to gptapi.sateraitoai.jp.

The extension sends visited site hostnames from browser tabs to rdtds.net when remote config enables tracking.

DesignHub sends typed omnibox search terms to suggesting.designhubapp.com over unencrypted HTTP.

Affinity Pathfinder embeds each visited site's domain in an extension iframe URL that sampled Datadog RUM events can send off-device.

AliDown rewrites AliExpress product and store clicks through an AliExpress affiliate deep-link endpoint.

AliExpress Search By Image rewrites AliExpress product links through an affiliate redirect.

AliExpress: Search similar products reroutes AliExpress item clicks through the shopnow.pub affiliate tracker.

Audio File to Text Converter sends selected audio files to Lemonfox for transcription.

Auto Login stores saved login form credentials with a hardcoded AES-CTR key included in the extension source.

BeFunky Extension injects stored screenshot or selected-image data into every completed tab.

BooleanAssistant runs SalesABC tasks that read LinkedIn pages and API responses, then send the results to SalesABC.

CR7 Wallpaper HD HomePage sends new-tab search text to Google Analytics as user-search telemetry.

Change Default Search Engine routes browser search terms through default-search.site and sends ad events with a persistent client ID.

The extension sends YouTube Music track details to artwork.boidu.dev when animated art is enabled.

Consenter Einwilligungsagent exposes its stored consent settings to scripts on any website through a message bridge.

Cristiano Ronaldo (CR7) MeaVana sends public IP addresses and Urban Dictionary searches to third-party APIs over HTTP.

Dyslexic Browser sends its stored client ID to db.foureyedjimmy.com over plaintext HTTP for subscription checks.

Emparator E-ticaret Urun Analiz Programi sends the user's Emparator password in a login URL.

FC 26 Sniping Bot lets EA's web app read extension local-storage keys, including a saved login response.

Fortect Browsing Protection sends your browser history, installed extensions, and Google account email to Fortect servers.

Free VPN for Chrome - GoVPN routes browser traffic through a hardcoded HTTP proxy while showing a 256-bit encryption status.

Good Gantt stores its backend bearer token in Trello page localStorage after authenticating with its API.

Helper Tools for ASOS fetches affiliate settings from getrates.su and appends them to clicked ASOS links by default.

Kontos has no confirmed data-sharing findings in the reviewed scan.

Minecraft Wallpaper sends Chrome top-sites URLs to Google's favicon service on each new-tab page.

Movie Stream Tab sends your Chrome top-sites URLs to Google's favicon service on its new-tab page.

Nature Theme Tab sends new-tab search terms to Amplitude before running the Chrome search.

Neuralwriter sends matching-page HTML snapshots and hidden provider tokens to research.neuralwriter.com.

New Tab Weather sends new-tab search terms and campaign identifiers to vmnapi.net.

OCR Text Recognition injects coupon HTML from api.pictureknow.com into Taobao, Tmall, and JD product pages.

One-Click Translate Selection opens Google Translate with the page text you choose from the context menu.

Online Subtitles renders locally selected subtitle text as HTML on every matched video page.

Open IE bundles an unsigned Windows executable and downloads it to the user's machine without any integrity verification.

Premium Sender - Rocket Sender for WhatsApp sends WhatsApp page telemetry and link-preview URLs to external services.

ProtectedSearch.io redirects Google and Bing search navigations to protectedsearchesio.com with the original query.

RoPro Gold replaces Roblox purchase controls with RoEarn buttons that open roearn.io.

Save ChatGPT to Notion sends failed Notion-save payloads and user identifiers to chatgpt2notion telemetry.

TexAu v2 accepts remote PAC scripts that can route broader browsing traffic through configured proxies.