Medium risk browser extensions

Clifl reads YouTube page data and account identifiers during server-directed viewing tasks.

Cognism - Sales Intelligence Extension embeds a DataStax Langflow bearer token and sends AI prompt input to DataStax.

Cookie Decliner sends visible page text and the current URL from every HTTP(S) tab to carmesin.me.

CovidDash at Johns Hopkins University replaces browser search, homepage, and startup settings with coviddashboard.extjourney.com.

Cricket Score Bar inserts Cloudinary-hosted score images into every tab after a match is selected.

Ctrl+Tab MRU inserts current-window tab titles and tab IDs into the active webpage DOM.

The extension sends shopping-page product details and product links to Gobiz and Sabomall services.

Decopy AI sends YouTube video IDs and summary inputs to api.decopy.ai with a persistent device identifier.

Definio AI can send selected page text, screenshots, and account identifiers to Definio and analytics endpoints.

Easy Calendar Plan inserts vendor API responses into Google Calendar without escaping them.

Emat Smash - Hack til Emat uploads Grammatip result-page HTML and student identifiers to skolesnyd.byethost17.com.

FUT Alert - My Extension lets EA/FUT and FUT Alert pages read saved local storage and send imported club holdings to futalert.co.uk.

Flowchart Maker requires first-run survey answers and an email address, then sends them to quiz.swimming.run.

Free VPN Premium for Chrome - OnVPN sends each completed top-level navigation URL to www.runapps.org with a persistent user ID.

Freshy Recipes can send your Chrome top-sites list to its remote new-tab page.

Galaxy Creatures sends new-tab searches with persistent extension identifiers to search.galaxycreature.net.

Generate Strong Password creates passwords with Math.random when you use its editable-field context menu.

Geometric Structures sends new-tab searches with persistent IDs and displayed bookmark URLs to external services.

Google Meet Transcription uploads meeting transcripts to a remote AI summarization service.

GptAutoBOT sends /gpt prompts typed in page inputs, including sensitive fields, to ChatGPT.

Gradient Blobs sends rendered bookmark URLs to Google's favicon service on its new-tab page.

Gramatika includes a recoverable Katla API authorization token in its shipped popup code.

Grok AI sends sidebar chat messages to Together's chat-completions API using an embedded bearer key.

HD, Replay, Popout for YouTube sends popout video embed URLs to uslocaltv.appzend.net.

IPTV Tools can send Xtream IPTV usernames and passwords over HTTP when users enter an http:// server URL.

In Private Mode uses a hidden pinned Google tab to run backend-directed searches and report visited result URLs.

In-Page Piano Analytics lets active pages request and receive Piano Analytics article metrics.

InTab puts licensed users' persistent ID and license key in a cleartext HTTP uninstall URL.

Iris Wallet sends JSON-RPC requests to Nockblocks with a bundled API key.

Kabila Wallet sends wallet identifiers and an embedded HSuite API key to HSuite swap gateways.

Kondor encrypts wallet seed phrases and imported private keys using the same stored AES-GCM IV.

Language Learning with YouTube-AFL signs AI coach requests with an embedded secret and opens Apple sign-in over HTTP.

Learn Helper stores auto-login credentials reversibly in local browser storage with a hardcoded XOR key.

LibreOffice Impress online sends each top-level navigation URL pair with a persistent identifier to runapps.org.

LiftmyCV sends full job-application page HTML to app.liftmycv.com when autofill errors occur.

LinkMatch for HubSpot captures LinkedIn profile, contact, inbox, Sales Navigator, and Recruiter responses and sends them to LinkMatch.

Lock Your History stores its history-lock password and hint in plaintext browser sync storage.

Lookup - Website Profiler sends page HTML and URLs from visited sites to joinlookup.com when remote lookups need more data.

Lucky VPN & Proxy embeds a ProxySeller API key and uses it from the popup to retrieve proxy inventory.

Macify sends optional weather keys and city to WeatherAPI over HTTP and sends top-site origins to Google's favicon service.

MagickPen - ChatGPT Writing Assistant sends requests to api.magickpen.com with reusable signing secrets in its bundle.

Magnifying Glass places captured screenshots into the page DOM when a user activates its magnifier.

MailMagic reads Gmail thread bodies when you open a conversation and sends the content to app.mailmagic.ai.

Materio Selection Clipper sends user identity and clipper API traffic from its side panel to LogRocket.

Mermaid Graphical Editor exposes cached diagram text to the active page when you open its editor.

IG DM Sender stores your Instagram CSRF token in exported issue logs using reversible encoding and a bundled default key.

Minty Adblocker sends visited page URLs to Minty's merchant API after top-level page loads.

Modulr Wallet polls account state and submits signed transactions to hardcoded Modulr RPC endpoints over HTTP.

MultiVis Meeting sends meeting tokens and screen-sharing data over cleartext HTTP and WebSocket connections.

My world clock redirects new-tab search queries to search-it.cc with affiliate parameters.

Neat Tab sends new-tab search terms to its search servers with persistent install identifiers.

NewsWhip by Sprout Social sends its stored auth key to Google Analytics as the client ID on popup click events.

Next Pointer redirects Google search pages to npext.com and forwards the user's search query.

NotebookLM EDU Enhancer(TW) stores an AI Studio API key in NotebookLM page storage and exposes note text to parent frames.

Number Checker for WhatsApp sends typed WhatsApp message URLs to third-party link preview services.

Office Tools sends searches typed on its new-tab page to find.digital-marketing-ads.com.

OneClick sends LinkedIn profile details and email address to PostHog after reading LinkedIn cookies on job and feed pages.

OneNav sends each displayed saved bookmark URL to favicon.png.pub when loading favicons.

OpenSubtitles for Netflix stores OpenSubtitles login credentials in Netflix page localStorage.