Medium risk browser extensions

WhatRuns reads page HTML, email addresses, and server-selected page fields and sends them to whatruns.com.

Claude Usage Tracker stores Claude prompt and request details in local debug logs whenever it runs.

Utorrent For Firefox sends uTorrent Web UI credentials and torrent URLs over cleartext HTTP.

Image Downloader rewrites outgoing request Referer headers to the active tab's origin while its popup scans a page.

Youtube Defender routes YouTube and GoogleVideo traffic through hardcoded authenticated SOCKS proxies.

Check4Change sends monitored page URLs and selected page text to check4change.com for VIP email alerts over HTTP.

2FA Authenticator stores authenticator secrets and bypass credentials encrypted with passphrases shipped in the extension.

AI Translator sends text you ask it to translate to OpenAI with a bundled API credential.

AIPrompter saves AI prompt history in each supported site's localStorage.

Ambition watches non-password form fields and sends captured values to api.remoteambition.com.

ArchiveBox sends API keys and saved page URLs to user-configured ArchiveBox servers without requiring HTTPS.

Asin Gadget posts Amazon dangerous-goods ASIN matches to a Google Apps Script endpoint.

Baba Image Downloader redirects AliExpress and Alibaba product pages through rzekl.com affiliate links.

Canvas Hack hides focus and visibility changes from every HTTP(S) page after paid activation.

ChatSearch: ChatGPT for Search Engine (GPT4) logs search prompts with IP-derived fields and a UUID to Alibaba Cloud.

ComedyTab sends new-tab search queries and partner identifiers to find.wsrc-now.com.

Commanders Act Assistant reads cookies and page URLs from every tab every 4 seconds and sends them to privacy.trustcommander.net.

Competition Meter sends product images to Google Cloud Vision when users click its Inspect Product button.

Daily Planner sends your profile email, location, IP lookup data, screen size, and planner state to an AWS API.

Discord Instant Translation sends Discord chat text to its translation API over HTTP.

DontBugMe sends the active site's hostname to analytics and queries BugMeNot for shared credentials.

Download YouTube Transcript sends YouTube transcripts, video metadata, and activity events to ytranscript.app and Amplitude.

Dual Page Sync removes frame-embedding protections from sites opened in its split-tab view.

E-commerce Side-to-side to AI sends user-added product details and comparison links to its backend.

ELMessenger Pro reads Facebook friend birthdays and sends the records to next.cloudki.io every 30 minutes.

Easy Shop sends top browser history URLs to easyshopsoffers.com and reports visits matching server-chosen URL keywords.

FREE Twitter (X) Social Data Scraper sends scraped X posts, news, trends, and account details to Supabase.

Flipkart Image Downloader opens a background affiliate tab to sovrn.co when users download images.

Form Saver saves form values, including password and hidden fields, into the active page's localStorage.

GITHUBER - New Tab sends bookmark logo upload tokens and selected images over cleartext HTTP.

Get Screen Resolution sends new-tab search queries and typed URLs to yhereugo.com with affiliate identifiers.

Goodreads Right Click sends selected page text to Goodreads as a plaintext HTTP search query.

Homely can fetch your eBay cart page over cleartext HTTP for its optional basket widget.

JoggAI uploads the active page's full HTML and URL after you click Convert.

KDP Autofill sends license validation requests to autofill.mercherworld.com with embedded WooCommerce API credentials.

Libgen search sends popup search terms to selected Libgen proxy sites over HTTP.

LinkSnappy Elite sends login credentials in the LinkSnappy authentication URL and loads torrents over HTTP.

Little Bee sends click telemetry with page URL, referrer, screen size, and an ID to extanl.jtcrpa.com.

M3U IPTV sends playlist URLs to m3u-ip.tv over HTTP and lets that site read cross-origin responses.

Marter sends Download Buy List CSV exports to a hardcoded Google Apps Script endpoint.

Mega-Debrid Browser Extension sends login credentials to www.mega-debrid.eu/api.php as URL query parameters.

NotBlockNet VPN returns its proxy token to every HTTP authentication challenge.

OpenL Translate sends translation requests to api.openl.io with hardcoded API secrets bundled in the extension.

PromptFolder stores your account password and login tokens in Chrome local storage after you sign in.

SaleFlow captures Wildberries seller details and sends remotely requested search results to SaleFlow servers.

Save Website as PDF sends Google Analytics events when users generate PDFs and interact with the popup.

Security-Header-Extension sends the active tab URL and security response headers to 129.82.174.202.

SellerAider Toolkit sends Depop page URLs, page HTML, and usage/error telemetry to Discord and SellerAider endpoints.

SherpaDesk loads its mobile login over HTTP and stores returned account token values in local browser storage.

Similar Inc | Shopping Comparison Co-Pilot sends a persistent user ID and non-product page URLs to Similar Inc.

Stat Vin sends Manheim cookies and auction-site login/page activity to AuctionGate.

Strong Password Generator creates passwords with Math.random instead of a cryptographic random source.

Tabee: Tab Modifier displays open-tab and bookmark search results in page-readable overlays on every site.

Tally Tab sends searches typed on its new-tab page to r.bsc.sien.com with affiliate tracking parameters.

TanglePay IOTA Wallet lets connected websites request its stored API login token.

TasteWP sends detected WordPress plugin slugs to plugins.svn.wordpress.org when its popup enriches results.

Textverified lets Textverified web pages, including HTTP pages, change proxy settings and read extension storage.

TikTok Cleaner sends TikTok feed, search, like, favorite, and repost video lists to Kolsprite.