Medium risk browser extensions

UpAlerts: AI Cover Letters exposes its account email to scripts on Upwork, Fiverr, and LinkedIn through a page event bridge.

WAPI Extractor sends WhatsApp Web page details and a persistent client ID to Google Analytics.

Wandrer Map Overlay lets scoped route-planning pages read saved extension storage, including the user's Wandrer API key.

World Weather redirects new-tab search queries to search.world-weather-extension.com with a fixed tracking ID.

Writer Watch embeds a WordPress API authorization key and sends user and book IDs to writerwatch.com.

iTour chat translation sends page text for translation to a cleartext HTTP endpoint.

leetcode cheatsheet sends problem page HTML, URL, title, language, and editor code to RapidAPI when you click write solution.

mdpi_home stores your MDPI login token in a non-secure cookie and renders notifications into active pages.

AboveVTT loads Dropbox and YouTube scripts into authenticated D&D Beyond VTT pages.

PAYBACK Internet Assistent includes PAYBACK API credentials and uses them for CAPI requests.

AdBlocker Diamond can load server-selected scripts into matching web pages.

Save Facebook Ads & Reveal Ad Spend - Adscan.ai reads and writes Facebook ad reach cache entries on Upstash.

AliExpress CSV Export redirects AliExpress product and store clicks through clickwrap.xyz once per day.

AliSaving Plus opens AliExpress product and store clicks through a hardcoded affiliate deep-link URL.

Architecture Tab sends new-tab search queries to srchingoz.com with affiliate parameters.

BestStore Printer Launcher exposes an unvalidated HTTP proxy via its external messaging API, reachable by any localhost page.

BinoBot sends Binomo authtoken and device_id cookies in a remote-configured WebSocket connection URL.

Bitcashback uploads stored popup interaction logs with active-tab domains and the logged-in email to bitcashback.net.

BlankADS sends browser and ruleset status to ads-blank.com and applies remote request-blocking and CSS rules.

Brawl Stars Cursors redirects Google search pages to ugnewtab.net with the user's query.

Cashback service Paidwork can send its stored Paidwork user ID to a page-controlled URL after a click.

ChatGpt VPN fetches its proxy server list from public pages and routes browser traffic through those servers.

Check US Visa Slots sends AIS appointment details and an appointment-form screenshot to app.checkvisaslots.com.

CiteMaker CiteWeb sends login credentials to citemaker.com using GET requests.

Comment Stack records its extension UI pages and sends DOM snapshots and input events to tglens.tabgraf.com.

Etsy Downloader sends Etsy page URLs and search terms to Aliyun Logs when download controls are used.

ExtraPe - Affiliate Link Converter sends account passwords in authentication URL query strings to www.extrape.com.

FIVERR + sends Chrome profile and Fiverr account details to fiverr-plus.vercel.app on install and startup.

Fotor Design opens selected page image URLs on Fotor over plaintext HTTP.

Gemini EDU Prompt Assistant (TW) stores your Gemini API key in gemini.google.com localStorage and sends it to Google's API.

Get Maps & Driving Directions sets bestfreemaps.com as the default search provider for omnibox searches.

Lazada Save reports Lazada product-page visits to imgvidcfig.com and can route the tab through a returned URL.

LinkMatch for Pipedrive pulls LinkedIn profile targets from its server and fetches them using your logged-in session.

Minimalist Tab routes browser and new-tab search queries through ad-block-pro.co and track.clickcrystal.com.

Mojo runs JavaScript function strings fetched from its own server inside every website you visit.

Moni sends the user's bearer access token in its trading WebSocket URL.

Ntro.io can send interview-page screenshots and transcript text to api.ntro.io after remote websocket commands.

OUI9 HLS PLAYER M3U8 lets web pages drive tab-level request header changes through its public player page.

Random wallpaper sends typed new-tab search queries to suggest.findit-all.com for suggestions.

SEO Toolkit contains a remote-controlled redirect mechanism that can send the browser to a third-party URL before a page loads.

Search by image on Aliexpress sends visited URLs to apiheaven.io and can redirect tabs through apiheaven.io/pulse.

SkoleGPT Webudvidelse reads DOM text and screenshots from every active tab and transmits them to llm.dbc.dk using hardcoded API keys.

Technion Plus Plus embeds GitHub API tokens and uses them to upload shared course histogram data to GitHub.

The Optimiser asks a publisher-controlled endpoint for URLs and can open them in browser tabs each day.

Top Best Extension sends each top-level navigation URL and open-tab count to top-best.com.

WA Filter & Number Checker sends your Google profile email and WhatsApp number to its backend.

WB BHUMI PRINT stores Remember Me email and password credentials in extension storage for up to one year.

Zinx opens a first-login welcome page with the user's bearer token in the URL.

The extension sends selected page text to Youdao's HTTP translation endpoint for lookup.

Image Downloader rewrites outgoing request Referer headers to the active tab's origin while its popup scans a page.

WhatRuns reads page HTML, email addresses, and server-selected page fields and sends them to whatruns.com.

Utorrent For Firefox sends uTorrent Web UI credentials and torrent URLs over cleartext HTTP.

YouTube Shorts Blocker loads Google Fonts from its popup, sending request metadata to Google.

Youtube Defender routes YouTube and GoogleVideo traffic through hardcoded authenticated SOCKS proxies.

Check4Change sends monitored page URLs and selected page text to check4change.com for VIP email alerts over HTTP.

2FA Authenticator stores authenticator secrets and bypass credentials encrypted with passphrases shipped in the extension.