Medium risk browser extensions

Tomo Wallet embeds static backend authorization credentials for its Bitcoin RPC and BRC20 API requests.

TransorAI includes hardcoded credentials for OCR, Microsoft Translator, and Zhipu AI services.

UchiX sends Uchi.ru access tokens and school account details to api.cdz.rip while solving tasks.

Wallpapers - New Tab sends searches from its new-tab page to khereugo.com with affiliate parameters.

The extension sends the Wildberries WILDAUTHNEW_V3 session cookie to external.alteit.ru.

Wistia Video Downloader sends download telemetry, including page URLs and video IDs, to caverdant.online.

Zillow Redfin Realtor Real Estate Supercharge injects Inspectlet tracking code into Redfin, Zillow, and Realtor pages.

ZoomSelling forwards a seller Uzum access token from ad campaign pages to its backend.

有道词典右键查询 sends selected text from its context-menu lookup to dict.youdao.com over HTTP.

词匠-AMZ海量关键词运营 embeds a default CiJiang API signing token used to sign requests to api.cijiang.net.

Tipli runs on all websites, reads page text with server-supplied selectors, and sends it with the page URL to Tipli.

Pop2Watch scans visited pages for remote patterns and sends page URLs, titles, and matched links to api.pop2watch.com.

Instant Data Scraper reboot can load jQuery from code.jquery.com into the active tab when bundled injection fails.

ScreenShot stores user-triggered screenshots with page URL and title, then displays the image inside addonx.net/thisshot.

CDA Downloader opens short.ovh tabs during most CDA.pl link clicks and some download clicks.

SkipIt Adblocker for Youtube can send current page URLs to endpoints chosen by remote configuration.

Ghelper disables other enabled browser extensions that request proxy access.

ReYohoho Twitch Proxy sends the Twitch auth-token cookie to its rte.net.ru proxy servers.

AMA Interview AI sends selected text and page URLs to amainterview.ai, then renders API-provided HTML into pages.

Abstract Art Tab sends searches from its new-tab page to find.asrcnav.com with affiliate parameters.

Advanced Download Manager ADM links its required desktop installer over cleartext HTTP.

Advigator scrapes Amazon seller contact and storefront details and sends them to Advigator.

Agent for WeChat sends GPT reply events, including WeChat prompt and reply fields, to PostHog when analytics is configured.

Ali Assist redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliDownloader Plus redirects one AliExpress link click per day through clickwrap.xyz in a background tab.

Amazon Book List Downloader sends the full license key to Google Analytics after successful licensed exports.

ArqSign Certificado Digital lets HTTP-scoped vendor pages send signing requests to its native bridge.

Automate Bing Searches Rewards sends default and automated search queries to howtodowork.com.

Blackfy fetches a Google Sheets affiliate map and redirects matching visited domains to configured affiliate URLs.

BookMiner sends embedded Keepa and DataForSEO API credentials to third-party APIs during Amazon research features.

Bookmarker for YouTube loads saved video thumbnails over cleartext HTTP from YouTube's image server.

CallHippo-Virtual Phone System lets any webpage open its dialer popup for a chosen phone number.

Canopy GUI Enhancer sends hovered MAC addresses from Cambium admin pages to maclookup.info as executable JSONP.

Cats & Kittens Wallpapers sends new-tab search terms to search.cats-wallpaper.com.

CiteMaker CiteWeb sends login credentials to citemaker.com using GET requests.

Color Picker for Chrome captures the visible tab and inserts the screenshot into the active page as a readable canvas.

Daily Horoscope sends searches from its new-tab search box to daily-horoscope-ext.xyz.

DealsUpp wa message sender sends WhatsApp page details to Google Analytics and link URLs to preview services.

Discord Batch Deleter sends Discord channel URLs to slackext.com when a user starts batch message deletion.

Dispatcher Paragon Chrome Print sends access tokens and print-job documents over HTTP when HTTP mode is enabled.

EMB Tools sends your nickname and public IP to its proxy API over plaintext HTTP.

ERP Auto Login - IITKGP stores saved ERP passwords and security answers in plaintext when users save them without a PIN.

Ecto Wallet logs wallet seed phrases, private keys, and passwords to the extension console during wallet setup and import.

Email Generator renders remote email HTML from emailgenerator.24maxkazakov.ru inside an unsandboxed popup iframe.

EpubPressX sends the selected tab title to api-title-short.link2epub.com over plaintext HTTP.

Expressfy sends its stored account token to app.expressfy.com over cleartext HTTP during product override.

Futrich fetches JavaScript from futrich.com and runs it inside EA Ultimate Team pages.

Fiyat Geçmişi Plus can fetch a server-chosen URL with browser credentials and upload parsed listing data.

Get Transit Schedules makes gettransitschedules.com the default search provider and sends address-bar searches to it.

Grandstream GRP Click2Dial injects stored contact details into pages after matching selected text.

IG Followers Manager sends a built-in bearer token to the vendor API for process and account actions.

Infomon initializes Microsoft Application Insights page-view telemetry on every HTTPS page its content script loads.

InstaLens can record Instagram page sessions and sends Instagram profile report data to its servers.

JoyaGoo Warm Reminder Remover rewrites supported shopping product URLs with hardcoded affiliate referral codes.

Live Wallpaper: Luffy Straw Hat - One Piece adds campaign parameters to Google and Bing searches from its new-tab page.

Loadex injects a fetch hook that removes cancellation and deletion events from DAT and Truckstop live-match streams.

MasterCook stores remembered account passwords in local storage using reversible AES with a hardcoded key.

Memos sends bearer tokens and memo data to a user-configured Memos API URL, including over HTTP if that URL is used.