Medium risk browser extensions

CocoCut captures Cookie and Authorization headers from all HTTP requests and stores them in extension session storage.

This extension connects websites to the ЦСК user signature web library.

Hunter sends the domain of every website you visit to extension-api.hunter.io on each tab change and navigation.

Kimi WebBridge lets a local WebSocket service issue browser automation commands through Chrome debugger access.

Sets the browser homepage to MSN.com and provides Bing as the search engine.

Enhances YouTube watching with AutoHD, cinema mode, playback controls, and visual customization.

SingleFile saves web pages as single HTML files and injects content scripts on all URLs that accept unvalidated postMessage events, enabling cross-origin DOM capture.

Stacker - Falling tetra blocks! fetches ad content from a remote server and injects it as raw HTML into the extension popup, and opens background tabs on install and update.

This extension shows website safety ratings and warns about suspicious or harmful sites.

Ripple Tool sends raw mental-health search queries to Mixpanel and injects server-controlled HTML into search-engine pages.

Enhancer for YouTube exposes its preference object, including custom script and CSS text, to YouTube page scripts.

Bitly | Short links and QR Codes ships a hardcoded OAuth client_secret in its extension bundle.

E START sets the browser startup page to a plain-HTTP URL, sending each browser launch to start.jword.jp without encryption.

Focus To-Do ships hardcoded STOMP broker credentials in its bundle, connecting all users to a shared message queue at mq.focustodo.net.

NCapture sends a persistent per-installation UUID to its vendor server on every OAuth credential request and uses a hardcoded AES key to decrypt those credentials client-side.

Turns web searches and new tabs into support for ocean plastic cleanup projects.

Todoist for Chrome exposes its popup page to all websites and accepts navigation commands without verifying the sender's origin.

Browsec VPN probes remote-configured URLs bypassing its own proxy and sends a persistent user ID to its telemetry host on each page load.

BetterTTV stores its OAuth access and refresh tokens in Twitch page localStorage.

The extension sends PRO activation emails to videodroid.org and injects remotely-controlled notifications into YouTube pages.

Capital One Shopping collects Amazon purchase history, inferred location, and cross-site cookies and sends them to its servers.

2048 collects the user's Google account email and sends it as a player identifier to its game servers, including over plain HTTP.

Microsoft Bing Search Engine reads all browser cookies to find tracking codes and sends browser telemetry to g.ceipmsn.com daily.

Music Search for Chrome™ overrides the browser's default search engine and routes all search queries to amazingossearch.com with an affiliate tracking parameter.

Netflix Party matches every site you visit against server-supplied rules and fires background requests to whatever URLs its backend returns.

Adds searchable or user-provided subtitles to videos on streaming websites.

Voice Control for ChatGPT sends ChatGPT conversation URLs and page titles to Google Analytics with a persistent user identifier.

SaveFrom.net helper opens a WebSocket connection to sf-helper.com and can fetch arbitrary URLs on command using full browser permissions.

Shows the technologies used on the website you look up with a click.