Medium risk browser extensions

Tự động download tải ảnh video trên shopee sends extension account passwords to software.hukata.vn in URL query parameters.

UchiHelper sends Uchi.ru access tokens and uid cookies to dz-helper.ru while automating exercises.

View Forms creates and restores a long-lived uid cookie for viewforms.org.

Webphone API4COM sends CRM contact details, record URLs, and API4COM tokens to api.api4com.com for click-to-call.

YouTube Unblocker routes YouTube-related traffic through freeruproxy.ink proxy servers.

eSnipe Snipe Tool fetches remote button settings and injects eBay buttons that send item URLs to eSnipe.

teleprompt AI sends scraped page email addresses and prompt text from supported AI/chat sites to Mixpanel.

Saladict can send selected page and form text to Baidu Translate over cleartext HTTP.

Form History Control saves non-password form entries from every site and can reuse single-line entries on other sites.

YouTube MP4 fetches remote rules that can inject an iframe into matching pages and pass it the full page URL.

The extension removes Claude's malicious-prompt caution banner on claude.ai pages.

Browse.live Web Safety can collect page DOM text or attributes from any site and send them as telemetry.

X-notifier uses plain HTTP for some optional forum and mail checker requests, including credentials or mailbox data.

Alerta de ofertas e descontos injects a hidden whos.amung.us pixel and sends shopping page titles to descontosofertas.com.br.

Amazon Review Request Tool sends Seller Central query-performance reports to SellerApp.

Amazon Vine Ultraviner downloads code from ultraviner.com and registers it to run on Amazon Vine pages.

AutoGrok sends the signed-in Grok account email to Google Analytics and uploads selected image-reference files to imgbb.

Automatic message translator sends WhatsApp message text to translate-api.ext-api.com over HTTP.

BarnumPT fetches unpinned converter scripts from jsDelivr when importing FunnelWind HTML.

Canvas Hack hides focus and visibility changes from every HTTP(S) page after paid activation.

Cars Wallpaper sends new-tab search terms to qsrcfornow.com with affiliate parameters.

Cashback Assistant sends merchant-site visit events to Google Analytics with a persistent extension-generated client ID.

Chat AI opens a cleartext WebSocket that includes the signed-in Firebase user ID.

ChatGPT Prompt Assistant loads a Buy Me a Coffee image beacon on supported AI chat pages.

Runs Java Web Start JNLP applications in the browser without a local Java installation.

Cognism - Sales Intelligence Extension embeds a DataStax Langflow bearer token and sends AI prompt input to DataStax.

Cute Dogs Wallpaper sends new-tab search queries to cute-dogs-wallpaper-com.s1search.co.

Goldfire Highlighting allows any web page to collect cookies for arbitrary domains and forward them to a native host application.

Google Maps Extended Routes sends bookmark preview URLs to public CORS proxy services when direct fetching is blocked.

Google Search Console - Bulk URL Removal sends license validation requests to LemonSqueezy with a packaged bearer token.

Google Sheets Dark Mode runs delayed remote Google search tasks and sends browsing activity to refresh.simpledarkmode.com.

Instant Multi Search sends omnibox searches to Google Suggest over unencrypted HTTP.

Intentional sends extension analytics and blocked-page events with a persistent ID to PostHog.

KiotViet rewrites Facebook request headers and sends Messenger and GraphQL requests with scraped session tokens.

Runs the Krita graphics editor for digital art and 2D animation in the browser.

Learn Languages on YouTube & Netflix - zeroStudy sends watch-session details, an access token, and a bundled secret to Supabase.

Mailbutler for Gmail stores its API bearer token in Gmail page localStorage.

Mira for Chrome captures cookies, auth headers, and localStorage from pages opened with its skill-cookie URL marker.

MyWorlClock sends new-tab search terms to clock.myworl-clock.com.

NIXZ Plugin stores remembered NIXZ account passwords in Chrome sync storage after login.

Offer.love uploads collected bank card-offer details to api.offer.love every six hours.

PERRLA stores the user's account password in local browser extension storage after login.

Page Analytics sends the current page URL to pageanalytics.io and writes click heatmap data into page-readable attributes.

PiHole Browser Extension sends the Pi-hole API password to its default Pi-hole HTTP admin endpoint.

Post SMTP Notifications sends the signed-in user's Firebase UID over a cleartext WebSocket.

Revzap contacts ads-blank.com for remote rules that update request blocking and page CSS changes.

Savely sends visited domains and, when eligible, full page URLs with a persistent ID to savely-plugin.vercel.app.

Segsmart Web Plus rewrites WhatsApp Web's security policy and places login tokens in its uninstall URL.

Share and attach files in Gmail by cloudHQ sends Gmail account-switcher email addresses to cloudHQ.

Tab Merge sends all complete current-window tab URLs to the first tab's origin when you click its toolbar button.

Tabee: Tab Modifier displays open-tab and bookmark search results in page-readable overlays on every site.

Telegram Video Downloader sends Telegram chat names to Google Analytics when users download videos.

Telegram Video Downloader sends signed-in profile details to the web page that opened its auth page.

Tetrycs loads remote analytics scripts and inserts remote advertisement HTML in its popup.

TikTok unban - ban pass fetches remote rules that can rewrite visited tab URLs to server-supplied destinations.

Tiplino reads selected page text chosen by remote rules and sends it to www.tiplino.hu.