Medium risk browser extensions

Tetrycs loads remote analytics scripts and inserts remote advertisement HTML in its popup.

TikTok unban - ban pass fetches remote rules that can rewrite visited tab URLs to server-supplied destinations.

Tiplino reads selected page text chosen by remote rules and sends it to www.tiplino.hu.

Translate Web Page stores translated page text, page titles, and URLs in site-readable localStorage.

UpAlerts: AI Cover Letters exposes its account email to scripts on Upwork, Fiverr, and LinkedIn through a page event bridge.

Wandrer Map Overlay lets scoped route-planning pages read saved extension storage, including the user's Wandrer API key.

Web browser with anonymous access sends each non-OffiDocs tab URL to OffiDocs with a persistent local username.

World Weather redirects new-tab search queries to search.world-weather-extension.com with a fixed tracking ID.

Writer Watch embeds a WordPress API authorization key and sends user and book IDs to writerwatch.com.

iTour chat translation sends page text for translation to a cleartext HTTP endpoint.

leetcode cheatsheet sends problem page HTML, URL, title, language, and editor code to RapidAPI when you click write solution.

mdpi_home stores your MDPI login token in a non-secure cookie and renders notifications into active pages.

Browse.live Web Safety can collect page DOM text or attributes from any site and send them as telemetry.

AboveVTT loads Dropbox and YouTube scripts into authenticated D&D Beyond VTT pages.

PAYBACK Internet Assistent includes PAYBACK API credentials and uses them for CAPI requests.

AdBlocker Diamond can load server-selected scripts into matching web pages.

Save Facebook Ads & Reveal Ad Spend - Adscan.ai reads and writes Facebook ad reach cache entries on Upstash.

AliExpress CSV Export redirects AliExpress product and store clicks through clickwrap.xyz once per day.

AliSaving Plus opens AliExpress product and store clicks through a hardcoded affiliate deep-link URL.

Architecture Tab sends new-tab search queries to srchingoz.com with affiliate parameters.

AutoGrok sends the signed-in Grok account email to Google Analytics and uploads selected image-reference files to imgbb.

Automatic twitch translator sends Twitch chat text to translation providers and loads remote selector config.

BestStore Printer Launcher exposes an unvalidated HTTP proxy via its external messaging API, reachable by any localhost page.

BinoBot sends Binomo authtoken and device_id cookies in a remote-configured WebSocket connection URL.

Bitcashback uploads stored popup interaction logs with active-tab domains and the logged-in email to bitcashback.net.

BlankADS sends browser and ruleset status to ads-blank.com and applies remote request-blocking and CSS rules.

Brawl Stars Cursors redirects Google search pages to ugnewtab.net with the user's query.

Calligra online - office, graphics & email sends visited page URLs to OffiDocs with a persistent extension-generated username.

Cashback service Paidwork can send its stored Paidwork user ID to a page-controlled URL after a click.

Check US Visa Slots sends AIS appointment details and an appointment-form screenshot to app.checkvisaslots.com.

CiteMaker CiteWeb sends login credentials to citemaker.com using GET requests.

Comment Stack records its extension UI pages and sends DOM snapshots and input events to tglens.tabgraf.com.

Etsy Downloader sends Etsy page URLs and search terms to Aliyun Logs when download controls are used.

ExtraPe - Affiliate Link Converter sends account passwords in authentication URL query strings to www.extrape.com.

FIVERR + sends Chrome profile and Fiverr account details to fiverr-plus.vercel.app on install and startup.

Fotor Design opens selected page image URLs on Fotor over plaintext HTTP.

Gemini EDU Prompt Assistant (TW) stores your Gemini API key in gemini.google.com localStorage and sends it to Google's API.

Get Maps & Driving Directions sets bestfreemaps.com as the default search provider for omnibox searches.

Minimalist Tab routes browser and new-tab search queries through ad-block-pro.co and track.clickcrystal.com.

Mojo runs JavaScript function strings fetched from its own server inside every website you visit.

Moni sends the user's bearer access token in its trading WebSocket URL.

Ntro.io can send interview-page screenshots and transcript text to api.ntro.io after remote websocket commands.

OUI9 HLS PLAYER M3U8 lets web pages drive tab-level request header changes through its public player page.

PERRLA stores the user's account password in local browser extension storage after login.

Random wallpaper sends typed new-tab search queries to suggest.findit-all.com for suggestions.

SEO Toolkit contains a remote-controlled redirect mechanism that can send the browser to a third-party URL before a page loads.

Search by image on Aliexpress sends visited URLs to apiheaven.io and can redirect tabs through apiheaven.io/pulse.

SkoleGPT Webudvidelse reads DOM text and screenshots from every active tab and transmits them to llm.dbc.dk using hardcoded API keys.

Technion Plus Plus embeds GitHub API tokens and uses them to upload shared course histogram data to GitHub.

The Optimiser asks a publisher-controlled endpoint for URLs and can open them in browser tabs each day.

Top Best Extension sends each top-level navigation URL and open-tab count to top-best.com.

Udio AI Music Generator reads your Chrome profile ID and sends it to livepolls.app for extension login.

WA Filter & Number Checker sends your Google profile email and WhatsApp number to its backend.

WB BHUMI PRINT stores Remember Me email and password credentials in extension storage for up to one year.

Zinx opens a first-login welcome page with the user's bearer token in the URL.

The extension sends selected page text to Youdao's HTTP translation endpoint for lookup.