Medium risk browser extensions

YouTube Comment Search sends YouTube video and search request details to a hosted YouTube proxy API.

Superpower ChatGPT syncs ChatGPT conversation history and full conversation records to api.spchatgpt.com by default.

Quest PDF sets itself as the default search provider and sends search and suggestion terms to QuestPDF and Yahoo endpoints.

Pinned ChatGPT injects hidden affiliate iframes on whitelisted sites and sends the current site URL to trendupdeal.com.

YouTube Video Downloader injects a remote S3 script into every matched webpage.

Google Image Search Right Click opens a cleartext Google image-search URL containing the selected image URL.

Magic CSS fetches Sass compiler JavaScript from cdnjs and injects it into the active tab in Chromium browsers.

Tipli do prehliadača uses remote instructions to read matching page text and send it to Tipli's add-on API.

AutoSkipYT for YouTube posts Google or Bing search-page URLs to a remotely configured endpoint.

Y2Mate sends YouTube download requests with browser-generated authorization tokens to meowing.ssstik.art.

Circle reader sends account tokens and synced reading data to circlereader.com over cleartext HTTP.

YouTube UnBlock nikolaevevge routes YouTube, Google, ChatGPT, Facebook, Instagram, and IONOS traffic through SOCKS proxies.

YouTube Video Downloader Pro sends its phone-download button to an unrelated campaign site.

Wordtune sends readable page HTML, URL, and title from selected sites to its insights API.

Best Pdf Manuals Hub sends each HTTP(S) page URL and title to cen.bestpdfmanualshub.com.

SnapTube MP3 for YouTube Music Download adds YouTube download links that send video URLs to snaptube.audio over HTTP.

AdLock fetches remote filter rules that can inject server-supplied JavaScript into HTTP and HTTPS pages.

Advanced Downloader for Instagram sends search queries and result URLs to mtusgate.de and rewrites matched links.

Free Android online emulator ApkOnline sends non-ApkOnline tab URLs with a persistent user ID to www.uptoplay.net.

GitLab Markdown Viewer renders local Markdown files with raw HTML that can run unstripped event handlers.

Istoric Preturi sends matched merchant page snippets to api.istoric-preturi.info when its server requests extraction.

PiratBit routes all browser traffic through xuyvamebanyerkn.woman-beauty.top when its proxy is enabled.

Rutor Torrent Search sends typed popup searches to Google Suggest and opens submitted searches over cleartext HTTP.

Who Deleted Me can send full Facebook page responses to api.deleted.io when detailed error logging is enabled.

mail.com MailCheck embeds reusable OAuth client credentials and sends them in token requests for GMX, mail.com, and web.de accounts.

Tube Archivist Companion sends its API token and optional YouTube cookie export to user-configured HTTP servers.

LocalWeatherAlerts sends each completed page URL and tab context to its server for sponsorship responses.

Capital Koala sends login credentials to its API with the password embedded in the request URL.

Simple Form Fill can show saved form-fill snippets inside every visited page when autocomplete is enabled.

Torrent Finder Toolbar sends typed torrent search queries to Google Suggest over unencrypted HTTP.

Adblocker X fetches addonsrv.net rules that can inject controller iframes into matching websites and alter page content.

1688 dropshipping pro can send full-page HTML from matched shopping pages to the ZQ Drop backend.

ABC Wallet stores wallet account approval globally, letting unrelated web pages read the approved account address.

AHi WhatsApp翻译[AI版] reads WhatsApp contact names and phone numbers and sends them to wstrans.890214.net.

AI Anywhere for ChatGPT removes anti-framing headers from AI provider subframes while its editor is open.

AI Assistant sends selected text, GPT-prefixed form text, and page URLs to its AWS GPT backend.

AI Diagram Generator includes a hardcoded OpenRouter API key for diagram generation requests.

AI Magic sends selected or typed page text with the stored account JWT and email to its GPT proxy.

AI Tab Master rewrites shopping links with affiliate IDs and asks tabcategory.ptsolutionsnz.com for promoted AliExpress URLs.

AITransDub sends subtitle text, your user ID, and the video page URL to its translation, TTS, and telemetry APIs.

AdGuard Home Control sends Basic-auth credentials to user-configured AdGuard Home URLs, including HTTP endpoints.

Agenda Hero for Chrome logs selected page content and screenshot prompts to Datadog before sending them to Agenda Hero.

AliFast sends AliExpress and Alibaba product URLs to alisave.info and redirects tabs to returned affiliate links.

AliImage Search routes AliExpress product and store clicks through an eshopwell.xyz affiliate endpoint.

AliPal sends clicked AliExpress product URLs to dailyfinds.xyz through an affiliate redirect.

AliSave redirects AliExpress and Alibaba product pages through affiliate endpoints after enhanced features are enabled.

AliSave rewrites AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliSave Pro routes AliExpress product and cart pages through an affiliate deep link.

Amazon Affiliate Link Generator sends the active Amazon page URL to amazonspot.net for link shortening.

Amazon Quick BSR Rank creates Firebase Auth accounts with a hardcoded default password.

Anime4K WebExtension can add permissive CORS headers to all media responses when its cross-origin fix is enabled.

Annotate Web stores page-specific drawing and text annotation history in each visited site's localStorage.

Apploye Time Tracker stores remembered login credentials encrypted with a passphrase shipped in the extension.

Arc Peek: Link preview removes CSP and X-Frame-Options headers so linked pages can load inside its preview iframe.

Art New Tabs sends new-tab search terms to trends.search-hub.co when you press Enter.

Art Wallpapers New Tab sends typed new-tab search text to Mystart or SearchesSweet for search suggestions.

Article Galaxy Browser Extension scans pages for article identifiers and sends page details to its backend.

Aukcjoner.pl injects an Allegro SMS-code form into pages whose URL text contains allegro.pl.

BDFAST sends birth-verification identity records from BDRIS pages to bdfast.shamol.dev.

Bancarios Profit sends CSGO.net item, roll, and invoice details to ludraapi.site services.