Medium risk browser extensions

Daily Horoscope sends searches from its new-tab search box to daily-horoscope-ext.xyz.

DealsUpp wa message sender sends WhatsApp page details to Google Analytics and link URLs to preview services.

Discord Batch Deleter sends Discord channel URLs to slackext.com when a user starts batch message deletion.

Dispatcher Paragon Chrome Print sends access tokens and print-job documents over HTTP when HTTP mode is enabled.

EMB Tools sends your nickname and public IP to its proxy API over plaintext HTTP.

ERP Auto Login - IITKGP stores saved ERP passwords and security answers in plaintext when users save them without a PIN.

Ecto Wallet logs wallet seed phrases, private keys, and passwords to the extension console during wallet setup and import.

EpubPressX sends the selected tab title to api-title-short.link2epub.com over plaintext HTTP.

Expressfy sends its stored account token to app.expressfy.com over cleartext HTTP during product override.

Futrich fetches JavaScript from futrich.com and runs it inside EA Ultimate Team pages.

Fiyat Geçmişi Plus can fetch a server-chosen URL with browser credentials and upload parsed listing data.

Get Transit Schedules makes gettransitschedules.com the default search provider and sends address-bar searches to it.

Grandstream GRP Click2Dial injects stored contact details into pages after matching selected text.

IG Followers Manager sends a built-in bearer token to the vendor API for process and account actions.

Infomon initializes Microsoft Application Insights page-view telemetry on every HTTPS page its content script loads.

InstaLens can record Instagram page sessions and sends Instagram profile report data to its servers.

JoyaGoo Warm Reminder Remover rewrites supported shopping product URLs with hardcoded affiliate referral codes.

Live Wallpaper: Luffy Straw Hat - One Piece adds campaign parameters to Google and Bing searches from its new-tab page.

Loadex injects a fetch hook that removes cancellation and deletion events from DAT and Truckstop live-match streams.

MasterCook stores remembered account passwords in local storage using reversible AES with a hardcoded key.

Memos sends bearer tokens and memo data to a user-configured Memos API URL, including over HTTP if that URL is used.

Mercado Livre TrueSort fetches affiliate-link rules from bembarato.org and rewrites matching links on pages you visit.

Motorcycles Wallpaper sends searches typed on its new tab page to lsrcunow.com.

NoteTab - Save Your Thoughts sends new tab search queries and saved bookmark domains to external services.

Ogame Fast expeditions fetches and runs remote code from kds-tools.com on OGame game and lobby pages.

Omni Convert redirects default omnibox search queries to find.madmidas.net monetized results.

Pocket Prompt sends prompt context and account email to its API when users run a prompt.

Porto sends tweet archive link URLs to third-party preview and proxy services while building Bluesky embeds.

Prompt Engine Pro stores its API token as a page-readable cookie on ChatGPT pages.

PureTwitter sends X account block-list telemetry to puretwitter.ikeyly.cn over cleartext HTTP.

Quick Text Extraction writes OCR text from selected screenshots into the page DOM.

R Discovery: Academic Research sends article metadata to R Discovery and posts CleverTap analytics with a bundled upload passcode.

RSS Subscription Extension, Reader sends selected RSS feed URLs and reader options to rssmerge.flowsoft7.com over HTTP.

RankNow.ai fetches setup data from extension.ranknow.ai and inserts it into ChatGPT page HTML.

Recapio: AI Youtube Summarizer automatically sends YouTube watch URLs to Recapio's API for transcript/chat processing.

Safeguard Enterprise Password Vault opens its vault web UI with the bearer token embedded in the tab URL path.

Saturation Scout sends product-page URLs, matching store domains, and product image data to external services.

ScreenTime sends tracked website hostnames to Google's favicon service when its popup displays usage history.

Search by image on Alibaba sends visited URLs to apiheaven.io and can redirect a background tab from server-provided links.

SeoLift uses a plaintext seolift.pro control channel to inject ad overlays and open or redirect tabs after user activity.

The extension builds share links that send the active tab URL and title to multiple sharing services, some over HTTP.

Sharkdropship ships a recoverable API key used for license validation.

Shein Images Downloader sends signed-in account profile and subscription details to Mixpanel analytics.

Smart Color Picker and Palettes places visible-tab screenshots into pages during picker mode.

SnapThePrice opens a hidden affiliate redirect that includes the active tab URL.

StarNgage Instagram Profile Analyzer sends login emails and passwords to api.plus.starngage.com in a URL query string.

Stellar Mod For Slither.io sends saved team and tag passwords to scripts on slither.io and slither.com pages.

Swiggy Zomato Blinkit Spends sends active-tab Blinkit token values to Blinkit order-history endpoints.

Synclify sends video-detection failures with the full page URL and a persistent analytics ID to its API.

TikTok Cleaner sends TikTok feed, search, like, favorite, and repost video lists to Kolsprite.

TrackWapp Online Monitor records WhatsApp Web contacts' online sessions and sends them to trackwapp.online.

TradeSage redirects TradingView script bundles to tradesage.co and loosens TradingView's CSP.

Trust.Zone VPN Proxy sends account passwords to robocloud.top in a login URL query string.

TubeX.Chat places the saved LLM API key into a password field in the YouTube page DOM while settings are open.

Tubi Speeder sends Tubi profile identifiers, continue-watching history, and playback events to me3x.online.

Turbo Stream routes most browser traffic through 72.56.50.29:43799 when its Server 4 proxy option is enabled.

URIRANK - Alexa Traffic Rank sends each top-level navigation URL to urirank.com.

Video Downloader rewrites response headers for MP4 files and requests from noname.technology.

Video Editor by DriveEditor.com sends Google account emails in Google Analytics events from Drive pages and the editor.