Medium risk browser extensions

Virat Kohli MeaVana removes anti-framing headers when it loads third-party integrations in extension iframes.

WA Quick Group sends generated WhatsApp group invite links to third-party link-preview services during invite messages.

XPLA GAMES Wallet broadcasts wallet address changes to every open web page where its provider is injected.

Zabbix Vue can send Zabbix passwords or API tokens to user-configured HTTP API endpoints.

ideaocam makes camera media uploaded to Google Drive readable to anyone with the link.

multiAccounts modifies subframe headers to remove CSP and X-Frame-Options after site access is granted.

nDocuSoft sends NREGA workflow URLs with stored Digest values over cleartext HTTP.

x_Wallet uses PostHog flags to select wallet storage records and sends queued wallet_diagnostics data to PostHog.

Яндекс Вордстат Extension sends XMLProxy API keys and keyword queries to xmlproxy.ru over plaintext HTTP.

BlackJack 3D sends popup game identifiers to mines.cloudapi.stream and uses the response to control game behavior.

Imagus mod runs auto-updated remote sieve rules as code on every site.

Qui-Quo fetches server-selected content scripts and hot-patch code that can run on any site.

ScreenShot stores user-triggered screenshots with page URL and title, then displays the image inside addonx.net/thisshot.

Debrid-Link Plugin exposes link metadata in page DOM and lets HTTP(S) pages trigger notification actions.

[Unofficial] Saladict - Pop-up Dictionary sends selected text to Baidu translation and speech endpoints over HTTP.

Email Extractor collects email addresses from visited pages and sends batches to mailshunt.com.

InteractiveFics writes saved replacement values into matching pages where site scripts can read them.

Magnifying Glass (Hover Zoom) places a captured screenshot of the visible tab into the current page DOM.

ABV Notifier stores ABV account passwords in browser storage in a form recoverable with nearby stored data.

楽天ウェブ検索 sends batches of visited URLs, referrers, redirect chains, browser details, and a Rakuten cookie to Rakuten.

Gaming News Feed sends new-tab search terms to bethegamepro suggestions and submitted searches to Yahoo.

YouTube Adblocker injects a hidden remote iframe from modal.style on every website after an eight-hour delay.

Search Engines Helper sends user-created search engine definitions to http-request-echo-server.onrender.com.

Font Changer rewrites shopping links and queries deals99.com for affiliate promotion URLs.

.parse(Hub) sends selected Blip Desk ticket contact details to DeskSalesAI when a chat ticket is selected.

360 Ribbon fetches remote EHR rules that execute JavaScript while reading patient names and dates of birth.

AI 클래스 학생용 sends open tab URLs and classroom system-tab details to a teacher DirectHost.

ASUS Download Master Chrome Extension sends router login credentials to its default HTTP router endpoint.

AceConnect IN stores encrypted auth tokens using a hardcoded password bundled in the extension.

Ad Dimmer fetches remote rules from addimmer.com that can inject page-context scripts on visited sites.

Agency Dashboard SEO Extension sends the current site's domain to APILayer and WhatCMS from its popup tools.

Agent Quick Tools rewrites shopping-agent product and registration URLs with its own affiliate codes.

AiPrice reports matched browsing URLs to api.aliprice.com based on remote rules.

Aionda Mail sends classic login credentials and session IDs to mail.aionda.com in URL query strings.

Ali Hunter sends AliExpress product URLs to a Glitch service and rewrites AliExpress pages through affiliate links.

Ali Hunter rewrites AliExpress product and cart visits through affiliate links.

AliExpress & Alibaba Dark Mode forwards clicked shopping URLs to alitems.link affiliate redirects.

AliSave redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliVoice redirects matching AliExpress pages through affiliate deep links and sends the page URL to alisavetools.com.

Alibaba, AliExpress & 1688 Search by Image redirects matching product pages through rzekl.com affiliate links.

Aliexpress image downloader redirects AliExpress item, cart, and order pages through s.click.aliexpress.com.

Amazon Prime Subtitles & Dictionary adds your email and last watched Amazon URL to its uninstall URL.

App Studio sends popup search and download activity with a persistent install ID to an n8n webhook.

Apple Music(iTunes) Web Player sets Chrome searches to chromecrxstore.com and sends omnibox search terms there.

Atomic Fusion stores its login token in Bubble page cookies that host-page scripts can read.

Authenticator stores TOTP enrollment secrets using a hardcoded fallback key when access-key encryption is off.

Auto Answer Edunext sends captured EduNext authorization headers to chat.ptudev.net during user-ID lookup.

Auto BCC for Gmail sends saved Auto BCC rules and cached Gmail sender choices with support requests.

The extension sends Slack message text to translate-api.ext-api.com over plaintext HTTP for DeepL/GPT translation.

Bing Maps Leads Scraper places Google OAuth access and refresh tokens in its Mapleadscraper pricing page URL.

Bolt to GitHub sends project IDs and commit messages from GitHub uploads to Google Analytics with a persistent client ID.

Bookmark Preview sends bookmarked page URLs to Google favicon service when rendering bookmark previews.

BudgetBuddy sends new-tab search terms to suggestion and search redirect domains.

Calculator Extension sends searches typed on its new-tab page to brownmile.com.

CheckFlow Browser Relay can attach its local debugger relay to sites saved in its own blocklist.

Ciphix Mendix dev tools saves Mendix passwords and bearer tokens in page localStorage as plaintext.

Claude2PDF sends the active Claude page HTML to www.aihuoji.com when exporting a conversation to PDF.