Medium risk browser extensions

Online Subtitles renders locally selected subtitle text as HTML on every matched video page.

Open IE bundles an unsigned Windows executable and downloads it to the user's machine without any integrity verification.

Premium Sender - Rocket Sender for WhatsApp sends WhatsApp page telemetry and link-preview URLs to external services.

ProtectedSearch.io redirects Google and Bing search navigations to protectedsearchesio.com with the original query.

Quick Engine Switch routes address-bar search terms through quickengineswitch.com.

RoPro Gold replaces Roblox purchase controls with RoEarn buttons that open roearn.io.

Save ChatGPT to Notion sends failed Notion-save payloads and user identifiers to chatgpt2notion telemetry.

Search Toggler routes default omnibox searches through searchtoggler.com with the typed query in the URL.

Switch My Search sends default search queries to switchmysearch.com through its search provider and redirect rules.

TexAu v2 accepts remote PAC scripts that can route broader browsing traffic through configured proxies.

UpSearches sends search-event telemetry with persistent identifiers to webinline-usage.streamesh.net.

View Menu with Prices makes viewmenuprices.com the default search provider and sends omnibox queries there.

Web Collector for MAXQDA fetches page-provided image URLs with extension privileges and writes the image data back into the page.

Winter Snow Wallpaper sends most-visited site URLs to Google's favicon service on the new-tab page.

Zombie new tab sends searches and typed URLs from its new-tab box to spaceship-newtab.com.

gbfdrop stores the user's account password in plaintext browser extension storage.

we advocacy notification chrome extension sends Gmail recipient and subject metadata when a campaign signature is used.

Google Traduction sends selected text from any website to softnour.com for translation.

RoQoL sends Roblox play status, game identifiers, and friend activity to roqol.io.

VPN Free - Betternet VPN Proxy runs remote-configured coupon automation on merchant pages.

Karma navigates inactive Facebook profile tabs to read a birth year and send it to www.karmanow.com.

Power Thesaurus sends the current site origin to its API and shares selected iframe text with embedding pages.

ASO - Toolbox by StoreMaven sends profile email and store-page analytics to StoreMaven's App Engine endpoint.

AoneEnvRoute adds internal routing headers to all browser requests when certain environment profiles are active.

Archive.org Flip Book to PDF Downloader scans page images and canvas pixels from any active site when its popup runs.

Avo VPN provides a VPN-style popup and requests proxy access, with no confirmed external data recipients documented.

BeLikeNative sends selected text from any website to its AI backend and transmits telemetry including visited domains to the same server.

Cities HD Backgrounds in Your New Tab sends search-box queries to spntextension.com.

Corgi AI ships hardcoded Voicemaker and Google Analytics credentials in its extension bundle.

Demon Slayer Shinobu Kocho Wallpaper sends Chrome top-sites URLs to Google's favicon service on the new-tab page.

DesignHub sends omnibox suggestion queries to its suggestions server over cleartext HTTP.

Easy Driving Directions sends new-tab search box input to easydrivingdirections.com for autosuggest results.

Easy Slot Booking - USA (CGI) sends visa account details and appointment data to easyslotbooking.com.

EasyForm AutoFill stores saved form inputs by host and path, so HTTPS entries can be autofilled into matching HTTP pages.

FOP2 Extension sends password-derived authentication and click-to-call commands over cleartext WebSocket.

Faceit Stats by Eloking sends Steam profile lookups to FACEIT with a bundled API bearer token.

FindSCI retrieves a translator bearer token over HTTP before translating selected article text.

AroundDeal's B2B Contact Info extension reports every site you visit, not just LinkedIn, to its own backend while you're signed in.

Dark Mode for Google Docs runs remote-controlled Google search tasks and reports visited URLs to its server.

Happy Wild Cats tags default search requests with a persistent session ID sent to happycatswild.com.

Hello Kitty Wallpaper New Tab sends your top-site URLs to Google's favicon service on the new-tab page.

INSTAVPN fetches remote configuration that controls its proxy servers and checkout API domain.

Image Downloader Pro sends install and update telemetry with the active tab URL, public IP, and a persistent UUID to Aliyun SLS.

Innfinergy v5.06 fetches remote Firebase settings that control automatic features on Innergy pages.

Kawaak ships a hardcoded Captain Data API key and project ID inside its extension bundle.

Kuromi Wallpaper sends top visited site URLs to Google's favicon service on the new-tab page.

Live Cricket Score Bar inserts score API responses as HTML into every visited page after a match is selected.

LunaNotes returns its stored bearer token to matched YouTube and localhost pages through external messaging.

MMZap sends WhatsApp Web account identifiers and incoming message content to GrowSoft and runs its API responses in the page.

Mailto: Set Default Email to Gmail by cloudHQ sends Gmail account addresses to www.cloudhq.net during its pre-user check.

Move It loads a CloudNouns image in each exercise reminder tab, sending the request to api.cloudnouns.com.

My Hero Academia Anime Wallpaper sends Chrome top-sites URLs to Google's favicon service on the new tab page.

Nature Wallpapers sends new-tab search queries to search.landscape-wallpaper.com with a hardcoded tracking ID.

NimbusMind sends passcode recovery emails and unlock codes to livestartpage.com over cleartext HTTP.

PDF to text lets its vocabulary.live iframe request the active page URL, title, selected text, DOM content, and localStorage.

PriApps Print Extension 2 sends print jobs and device details to the configured PriApps server over HTTP by default.

Quick Translate sends shopping cart and checkout page URLs to charitypartners.net after its donation prompt is clicked.