Medium risk browser extensions

URL Link Previews for Gmail lists every signed-in Google account email and sends it to cloudHQ.

UpSearches sends search-event telemetry with persistent identifiers to webinline-usage.streamesh.net.

View Menu with Prices makes viewmenuprices.com the default search provider and sends omnibox queries there.

Web Collector for MAXQDA fetches page-provided image URLs with extension privileges and writes the image data back into the page.

Winter Snow Wallpaper sends most-visited site URLs to Google's favicon service on the new-tab page.

Zombie new tab sends searches and typed URLs from its new-tab box to spaceship-newtab.com.

gbfdrop stores the user's account password in plaintext browser extension storage.

we advocacy notification chrome extension sends Gmail recipient and subject metadata when a campaign signature is used.

Google Traduction sends selected text from any website to softnour.com for translation.

VPN Free - Betternet VPN Proxy runs remote-configured coupon automation on merchant pages.

RoQoL sends Roblox play status, game identifiers, and friend activity to roqol.io.

Power Thesaurus sends the current site origin to its API and shares selected iframe text with embedding pages.

Karma navigates inactive Facebook profile tabs to read a birth year and send it to www.karmanow.com.

ASO - Toolbox by StoreMaven sends profile email and store-page analytics to StoreMaven's App Engine endpoint.

AoneEnvRoute adds internal routing headers to all browser requests when certain environment profiles are active.

Archive.org Flip Book to PDF Downloader scans page images and canvas pixels from any active site when its popup runs.

Avo VPN provides a VPN-style popup and requests proxy access, with no confirmed external data recipients documented.

BeLikeNative sends selected text from any website to its AI backend and transmits telemetry including visited domains to the same server.

This extension lets users access Blender for 3D creation, animation, rendering, video editing, and visual effects.

Cities HD Backgrounds in Your New Tab sends search-box queries to spntextension.com.

Claude to PDF, Word and Google Docs reads your Chrome profile email on install and sends it with a generated ID to Thinksolv.

Corgi AI ships hardcoded Voicemaker and Google Analytics credentials in its extension bundle.

Demon Slayer Shinobu Kocho Wallpaper sends Chrome top-sites URLs to Google's favicon service on the new-tab page.

Easy Driving Directions sends new-tab search box input to easydrivingdirections.com for autosuggest results.

Easy Slot Booking - USA (CGI) sends visa account details and appointment data to easyslotbooking.com.

EasyForm AutoFill stores saved form inputs by host and path, so HTTPS entries can be autofilled into matching HTTP pages.

FOP2 Extension sends password-derived authentication and click-to-call commands over cleartext WebSocket.

Faceit Stats by Eloking sends Steam profile lookups to FACEIT with a bundled API bearer token.

FindSCI retrieves a translator bearer token over HTTP before translating selected article text.

AroundDeal's B2B Contact Info extension reports every site you visit, not just LinkedIn, to its own backend while you're signed in.

Google Chrome Profile Lock stores its profile-lock password and recovery key reversibly in Chrome synced storage.

Dark Mode for Google Docs runs remote-controlled Google search tasks and reports visited URLs to its server.

Happy Wild Cats tags default search requests with a persistent session ID sent to happycatswild.com.

Hello Kitty Wallpaper New Tab sends your top-site URLs to Google's favicon service on the new-tab page.

INSTAVPN fetches remote configuration that controls its proxy servers and checkout API domain.

Image Downloader Pro sends install and update telemetry with the active tab URL, public IP, and a persistent UUID to Aliyun SLS.

Innfinergy v5.06 fetches remote Firebase settings that control automatic features on Innergy pages.

Kawaak ships a hardcoded Captain Data API key and project ID inside its extension bundle.

Kuromi Wallpaper sends top visited site URLs to Google's favicon service on the new-tab page.

Live Cricket Score Bar inserts score API responses as HTML into every visited page after a match is selected.

LunaNotes returns its stored bearer token to matched YouTube and localhost pages through external messaging.

MMZap sends WhatsApp Web account identifiers and incoming message content to GrowSoft and runs its API responses in the page.

Mailto: Set Default Email to Gmail by cloudHQ sends Gmail account addresses to www.cloudhq.net during its pre-user check.

Move It loads a CloudNouns image in each exercise reminder tab, sending the request to api.cloudnouns.com.

My Hero Academia Anime Wallpaper sends Chrome top-sites URLs to Google's favicon service on the new tab page.

Nature Wallpapers sends new-tab search queries to search.landscape-wallpaper.com with a hardcoded tracking ID.

NimbusMind sends passcode recovery emails and unlock codes to livestartpage.com over cleartext HTTP.

PriApps Print Extension 2 sends print jobs and device details to the configured PriApps server over HTTP by default.

Quick Translate sends shopping cart and checkout page URLs to charitypartners.net after its donation prompt is clicked.

RSS Feed Generator for any site sends the active tab URL to Takeads when its popup opens.

Reminder captures copied and cut text from every website and stores it in local clipboard history.

Search AliExpress by Image redirects clicked AliExpress product links through searchbyimage.link.

Spotify VPN downloads remote proxy settings that can install a PAC script for browser traffic.

Stop Notifications sends default search suggestion terms to stopnotifications.com over HTTP.

SupportOn runs remote crawl jobs that collect page content, form values, screenshots, and request results from visited sites.

Surf Wallet embeds a live MoonPay signing secret and uses it to build checkout URLs for wallet addresses.

Thai Wallpaper sends new-tab search queries to goog.thai-wallpaper.com.

Twiclips sends Twitch clip and VOD URLs with a persistent user ID and IP-derived profile data to Alibaba Cloud logging.