Medium risk browser extensions

OpenWardrobe sends the current page URL to affiliate redirect services when you click its toolbar or hover-save controls.

PACify | The Proxy Manager fetches user-configured PAC files and applies them to Chrome proxy settings.

Pangeo sends account passwords in GeoEdge API URL paths during login and user-agent refresh.

Perplexity to obsidian - Batch Export sends export telemetry with conversation URLs, titles, client ID, and email to cf-node-api.aluo.app.

Postlight Reader uses remote rules to place full-page browser-download overlays on popular websites.

Product Search sends visited page URLs to apiheaven.io and can redirect tabs through apiheaven.io/pulse.

QR Code Scanner and Generator writes scanned QR text and a camera still into page-readable DOM on every site.

ReadLite posts selected text and highlight notes from reader mode to the host page.

Reflektive sends Gmail account and conversation metadata to its Reflektive web app.

Roblox Characters Custom Cursor loads selected cursor images from allcursor.com on pages you visit.

Robô de Comentários - Bot de Sorteios sends Instagram profile details, location, and device data to botsorteios.com.

SNDL opens its login page with saved credentials and the active tab URL in the address bar.

Safe Search Engine sends new-tab search terms to server.taskticks.com before opening Google SafeSearch.

Salvage Auction Research Tool sends auction page HTML and protected auction records to AuctionHunter.

SamuMoa stores the OBS PeerJS connection key in marshmallow-qa.com's page storage.

Search by image on Ebay sends visited page URLs to apiheaven.io and may redirect browser tabs from remote config.

Self Messenger sends your WhatsApp number to Google Apps Script and an HTTP quota endpoint.

Smart Fiverr sends Fiverr account details, including email and name, to Mixpanel during login and account changes.

SnapGen Flow imports remote GitHub selector settings that guide its Google Labs Flow page automation.

Somiibo redirects shopping and rewards sites through hardcoded affiliate/referral links.

Speed Dial Dogs sends new-tab search text to addonsearch.net and Bing.

Supercharge for Bolt.new embeds API keys and sends scrape and search requests to Firecrawl and 21st.dev.

Support with Mellowtel joins a Mellowtel WebSocket worker that can upload page URLs and HTML from all sites.

TEMU Hide Local Products fetches rules from iltekin.com that can alter Temu pages and add affiliate parameters to Temu URLs.

TYNA reuses saved manual proxy credentials for every browser authentication challenge while the proxy is active.

TabMetrics sends new-tab telemetry and search input to tracking and search services from its replacement new-tab page.

TheChannel Viewer for Gmail posts embedded-page URLs, titles, and engagement activity to parent frames.

Time Limit loads third-party JavaScript from cdn.muicss.com inside its extension popup.

Tokmate sends TikTok profile, search, video, account, and Ads API data to api.tokmate.com.

Travel Mapper sends saved activity names and source URLs to Amplitude analytics.

USAVisaSlot sends visa appointment dashboard screenshots and slot details to api.usavisaslot.com.

Udemy Downloader sends signed download and account-status requests to udemy-downloader-ext.vuvuive.org.

VPN Facebook fetches remote proxy rules that can replace its PAC script and route browser traffic through configured proxies.

VPN for Chrome by WizVPN sends encrypted browsing and referrer telemetry to wizvpn.net during page loads.

Velio collects Twitter/X, Reddit, and LinkedIn feed content and uploads it to api.requests.velio.co.

Video Downloader Professional Premium sends each visited HTTP(S) tab URL to runapps.org with a per-install identifier.

WA Blaster embeds a reusable bearer token for its CRM lead-update API in the installed extension package.

Whatsapp Plus records every visited URL and sends it to backendsagrado.onrender.com.

YouTube Watch Later Bulk Delete posts feature activity and a persistent user ID to youtubeshorts.ru.

ZKX Web3 Wallet sends a persistent instance ID and selected account address/balance to Ambire price requests.

Zima Nodes sends login credentials over HTTP when a ZimaOS address is saved without an HTTPS scheme.

aiApply copies job application inputs and generated AI output into Alibaba Cloud log events.

fubukicss-tool redirects and rewrites Figma application scripts using rules fetched from ecomfe.github.io.

repmafia.net tools rewrites referral cookies and shopping URLs on supported storefronts.

syncmarx uploads encrypted bookmark sync archives to the cloud using a bundled decryption key.

tb7.pl sends selected text or links and the current page's localStorage login value to tb7.pl when using its context menu.

text to speech ai sends app.scade.pro session cookie values to bot.izibit.net when that cookie changes.

التحضير الذكي v3 injects remote JavaScript into scoped school, government, and WhatsApp pages and sends their URLs.

The extension sends page URLs, referrers, and browser fingerprinting telemetry to p.baoyueai.com during UI actions.

포인트백 for ADPICK sends visited page URLs to ADPICK's shopping-link endpoint when an ADPICK login or affiliate ID is present.

V3 - Get Old YouTube Layout fetches JavaScript from vorapis.pages.dev and injects it into YouTube pages.

oneClipper oneNote web clipper sends page or selected content to Google Gemini for AI clipping features.

Discord Token Login injects popup-entered token text into Discord pages through unsafely constructed script code.

linkding extension sends active-tab URLs during opt-in precaching and can send API tokens over HTTP Linkding URLs.

Open In IINA injects page-controlled URLs into browser-executed JavaScript when opening media links.

AutoFormer+ stores visible form fields, including passwords, in each site's localStorage.

CardPointers X sends Bank of America SAMLResponse and RelayState values to ui-api.tripleup.dev during deals setup.

URL Shortener sends saved Cutt.ly API tokens and long URLs to app.thebyteseffect.com when shortening links.