Medium risk browser extensions

RSS Feed Generator for any site sends the active tab URL to Takeads when its popup opens.

Reminder captures copied and cut text from every website and stores it in local clipboard history.

Search AliExpress by Image redirects clicked AliExpress product links through searchbyimage.link.

Spotify VPN downloads remote proxy settings that can install a PAC script for browser traffic.

Stop Notifications sends default search suggestion terms to stopnotifications.com over HTTP.

SupportOn runs remote crawl jobs that collect page content, form values, screenshots, and request results from visited sites.

Surf Wallet embeds a live MoonPay signing secret and uses it to build checkout URLs for wallet addresses.

Thai Wallpaper sends new-tab search queries to goog.thai-wallpaper.com.

Twiclips sends Twitch clip and VOD URLs with a persistent user ID and IP-derived profile data to Alibaba Cloud logging.

Tự động download tải ảnh video trên shopee sends extension account passwords to software.hukata.vn in URL query parameters.

UchiHelper sends Uchi.ru access tokens and uid cookies to dz-helper.ru while automating exercises.

View Forms creates and restores a long-lived uid cookie for viewforms.org.

YouTube Unblocker routes YouTube-related traffic through freeruproxy.ink proxy servers.

eSnipe Snipe Tool fetches remote button settings and injects eBay buttons that send item URLs to eSnipe.

teleprompt AI sends scraped page email addresses and prompt text from supported AI/chat sites to Mixpanel.

Form History Control saves non-password form entries from every site and can reuse single-line entries on other sites.

DesignHub sends typed omnibox search terms to suggesting.designhubapp.com over unencrypted HTTP.

YouTube MP4 fetches remote rules that can inject an iframe into matching pages and pass it the full page URL.

Saladict can send selected page and form text to Baidu Translate over cleartext HTTP.

The extension removes Claude's malicious-prompt caution banner on claude.ai pages.

X-notifier uses plain HTTP for some optional forum and mail checker requests, including credentials or mailbox data.

Alerta de ofertas e descontos injects a hidden whos.amung.us pixel and sends shopping page titles to descontosofertas.com.br.

Amazon Review Request Tool sends Seller Central query-performance reports to SellerApp.

Amazon Vine Ultraviner downloads code from ultraviner.com and registers it to run on Amazon Vine pages.

Automatic message translator sends WhatsApp message text to translate-api.ext-api.com over HTTP.

BarnumPT fetches unpinned converter scripts from jsDelivr when importing FunnelWind HTML.

Cars Wallpaper sends new-tab search terms to qsrcfornow.com with affiliate parameters.

Cashback Assistant sends merchant-site visit events to Google Analytics with a persistent extension-generated client ID.

Chat AI opens a cleartext WebSocket that includes the signed-in Firebase user ID.

ChatGPT Prompt Assistant loads a Buy Me a Coffee image beacon on supported AI chat pages.

Cookie Editor lets a tumutuk.com paywall iframe enable an affiliate tag on Amazon product-page visits.

Cute Dogs Wallpaper sends new-tab search queries to cute-dogs-wallpaper-com.s1search.co.

Docs Offline sends pasted text, page details, quiz content, and page images from all sites to ClipKey servers.

GeoGuesser Hacker can capture the active tab in Fast/Max mode and send the screenshot to its Firebase backend.

Goldfire Highlighting allows any web page to collect cookies for arbitrary domains and forward them to a native host application.

Google Maps Extended Routes sends bookmark preview URLs to public CORS proxy services when direct fetching is blocked.

Google Search Console - Bulk URL Removal sends license validation requests to LemonSqueezy with a packaged bearer token.

Google Sheets Dark Mode runs delayed remote Google search tasks and sends browsing activity to refresh.simpledarkmode.com.

Instant Multi Search sends omnibox searches to Google Suggest over unencrypted HTTP.

Intentional sends extension analytics and blocked-page events with a persistent ID to PostHog.

KiotViet rewrites Facebook request headers and sends Messenger and GraphQL requests with scraped session tokens.

Learn Languages on YouTube & Netflix - zeroStudy sends watch-session details, an access token, and a bundled secret to Supabase.

Mailbutler for Gmail stores its API bearer token in Gmail page localStorage.

Mira for Chrome captures cookies, auth headers, and localStorage from pages opened with its skill-cookie URL marker.

Music Downloader Premium sends each browsed page URL with a persistent user ID to www.runapps.org.

MyWorlClock sends new-tab search terms to clock.myworl-clock.com.

NIXZ Plugin stores remembered NIXZ account passwords in Chrome sync storage after login.

Offer.love uploads collected bank card-offer details to api.offer.love every six hours.

Page Analytics sends the current page URL to pageanalytics.io and writes click heatmap data into page-readable attributes.

PiHole Browser Extension sends the Pi-hole API password to its default Pi-hole HTTP admin endpoint.

Post SMTP Notifications sends the signed-in user's Firebase UID over a cleartext WebSocket.

Revzap contacts ads-blank.com for remote rules that update request blocking and page CSS changes.

Savely sends visited domains and, when eligible, full page URLs with a persistent ID to savely-plugin.vercel.app.

Segsmart Web Plus rewrites WhatsApp Web's security policy and places login tokens in its uninstall URL.

Tab Merge sends all complete current-window tab URLs to the first tab's origin when you click its toolbar button.

Telegram Video Downloader sends Telegram chat names to Google Analytics when users download videos.

Telegram Video Downloader sends signed-in profile details to the web page that opened its auth page.