Medium risk browser extensions

Wordtune captures the full HTML content of AI chatbot pages and transmits it to its own servers.

Search and download free Android app APK or XAPK files from APKPure.

This extension replaces the default Chrome pointer with customizable cursors for web browsing.

CocoCut captures Cookie and Authorization headers from all HTTP requests and stores them in extension session storage.

This extension connects websites to the ЦСК user signature web library.

Sets the browser homepage to MSN.com and provides Bing as the search engine.

Enhances YouTube watching with AutoHD, cinema mode, playback controls, and visual customization.

Stacker - Falling tetra blocks! fetches ad content from a remote server and injects it as raw HTML into the extension popup, and opens background tabs on install and update.

This extension shows website safety ratings and warns about suspicious or harmful sites.

Hunter sends the domain of every website you visit to extension-api.hunter.io on each tab change and navigation.

Lightning Autofill fetches encrypted JavaScript from its servers and injects it into every web page for paid license holders.

Ripple Tool sends raw mental-health search queries to Mixpanel and injects server-controlled HTML into search-engine pages.

SingleFile saves web pages as single HTML files and injects content scripts on all URLs that accept unvalidated postMessage events, enabling cross-origin DOM capture.

Enhancer for YouTube exposes its preference object, including custom script and CSS text, to YouTube page scripts.

Bitly | Short links and QR Codes ships a hardcoded OAuth client_secret in its extension bundle.

Focus To-Do ships hardcoded STOMP broker credentials in its bundle, connecting all users to a shared message queue at mq.focustodo.net.

NCapture sends a persistent per-installation UUID to its vendor server on every OAuth credential request and uses a hardcoded AES key to decrypt those credentials client-side.

Turns web searches and new tabs into support for ocean plastic cleanup projects.

Todoist for Chrome exposes its popup page to all websites and accepts navigation commands without verifying the sender's origin.

Browsec VPN probes remote-configured URLs bypassing its own proxy and sends a persistent user ID to its telemetry host on each page load.

BetterTTV stores its OAuth access and refresh tokens in Twitch page localStorage.

Capital One Shopping collects Amazon purchase history, inferred location, and cross-site cookies and sends them to its servers.

The extension sends PRO activation emails to videodroid.org and injects remotely-controlled notifications into YouTube pages.

2048 collects the user's Google account email and sends it as a player identifier to its game servers, including over plain HTTP.

Microsoft Bing Search Engine reads all browser cookies to find tracking codes and sends browser telemetry to g.ceipmsn.com daily.

Music Search for Chrome™ overrides the browser's default search engine and routes all search queries to amazingossearch.com with an affiliate tracking parameter.

Netflix Party matches every site you visit against server-supplied rules and fires background requests to whatever URLs its backend returns.