Medium risk browser extensions

Big Cupom redirects AliExpress pages through Awin with the full current URL in the affiliate request.

BlackTom AI sends quiz page URLs, cookies, page HTML, and configured LMS scrape results to htm88.org endpoints.

Bookface Companion sends Gmail thread participant email addresses to Bookface when Gmail conversations load.

书签地球助手 sends visited page URLs and titles to its statistics endpoint when record-visit mode is enabled.

Bot Assistant reads authToken values from the active page's localStorage for use in its side panel.

BybitEye sends Bybit P2P order, counterparty, chat card, and phone details to bybiteye.tradecode.tech.

CNfans Modal Remover rewrites CNFans product and account URLs to 2024 subdomains and adds affiliate ref=56000.

CSR vs SSR Detector has no confirmed data-sharing findings in this scanner.

Cache Cleaner redirects visits to supported shopping sites through embedded affiliate URLs once per day.

Calculator sends the selected image URL to calculatornow.info when its image context-menu action is used.

Cashback Easy reports active tab origins for store matching and sends overlay telemetry to Google Analytics.

Cassidy can send webpage text and selected screenshots to app.cassidyai.com when page messages trigger its bridge.

Catholic Central GPA Calculator injects a remote GitHub Pages module into MySchoolApp pages.

Chat GPT Side Bar MeaVana sends stored session tokens to PostHog during some expired-session logout flows.

ChatGPT AI assistant for Google Reviews and Questions sends your Google account name and email to Mail Magic.

ChatGPT to PDF sends subscription-check email addresses to Google Analytics.

Check and view XML - VNPT_HNI sends XML export requests with a page UUID or fallback token to VNPT RestService.

ClickApporter sends Amazon cart, product-view history, search terms, and saved-item ASINs to clickapporter.com during checkout.

CloudVPN routes all browser traffic through an unencrypted HTTP proxy when its VPN toggle is on.

Color Picker Chrome Extension sends completed tab URLs and referrers to colors.color-ninja.com with a persistent user ID.

Custom Chrome Shortcut Manager sends shortcut URLs, searches, calculator expressions, and aliases to Google Analytics.

Custom Fields for Google Calendar records its extension panels and sends DOM, URL, page title, and form input events to tglens.tabgraf.com.

IG DM Bot rewrites Instagram framing protections and changes selected site cookies to SameSite=None.

Deal Search Pro makes dealsearcherpro.com the default search provider for address-bar searches.

DirectStayz sends Booking.com hotel page URLs to Plausible and can rewrite search-result links through Awin.

Discord Chat Exporter embeds unescaped Discord message content in saved HTML exports.

DocSend to PDF sends DocSend cookies and document details to docsend2pdf.co when a view page opens.

Dofus Translator fetches live GitHub translation maps and inserts their values into the current page as HTML.

Domain Inspector sends router Basic-auth credentials to user-configured router origins, including cleartext HTTP addresses.

Dropeex stores your account password and login token in Chrome sync after you sign in.

EE-Updation Filler loads remote Netlify scripts into government RCH health-data pages.

ESI eSIP Chrome Extension copies a PBX websession cookie into synced extension storage after login.

Easy Apply Automater saves LinkedIn Easy Apply answers in linkedin.com localStorage.

Easy SEO Extension sends Google scraping requests through ScraperAPI with a bundled API key.

EasyRelay lets its server trigger Amazon Relay API requests from relay.amazon.com and receive the responses.

EditAnyCookie fetches Netlify configuration that can show a full-screen notice on configured sites.

Elden Ring 4k Wallpaper HD HomePage sends new-tab search keywords to Google Analytics.

Email Sender Icons by cloudHQ sends Gmail account email addresses to cloudHQ during Gmail page loads.

English <-> Thai Dictionary sends typed and selected lookup text to Longdo endpoints over cleartext HTTP.

English Popup Dictionary sends selected words, page URLs, IP addresses, and user agents to advertising services during lookups.

Extract Text From Picture sends AI OCR screenshots and uploaded images to 158.160.66.115 over plaintext HTTP.

Fashion Background Pictures New Tab sends new-tab search queries to feed.mambosearch.com with publisher and barcode IDs.

Fastcup Helper includes a FACEIT bearer token in requests from its content script.

Fat cat screenshot routes Chrome update checks through agency.pictureknow.com when its update test fails.

Fiyat Geçmişi sends Trendyol product, search, coupon, and add-to-basket details to tyol.refinementpoker.online.

Flip YouTube and turn youtube video sideways sends YouTube page URLs and video IDs to analytics.wrongorbit.com.

Flow VPN sends login credentials through an encrypted API wrapper whose hardcoded key ships in the extension.

FoxTransfer sends store credential validation details to Foxify with a reusable private API key embedded in the extension.

Free Bulk Sender for Messenger sends WhatsApp bulk-message task details and AI prompts to vendor endpoints.

GOAT - AI Summaries reads page text from visited sites and sends it to a Vercel API after install.

GPT帮我翻译 sends selected text to OpenAI or ChatGPT and stores a ChatGPT session cookie in synced extension storage.

GemFold renders saved Gemini folder and chat links into the active page when its toolbar button injects the sidebar.

Geocaching.com Google Drive Notes stores a Google Drive OAuth token in geocaching.com page localStorage.

Global Gym Software SMS Sender sends the WhatsApp login number and account email to wpsender.globalcrm.in when a batch starts.

Goodkey sends text from active webpages to mcc.r-broker.ru while its page indexing feature is active.

Google Analytics UTILS sends the active tab domain and a _ga cookie-derived client ID to Amplitude.

Google Chrome Profile Lock stores its profile-lock password and recovery key reversibly in Chrome synced storage.

Google Takeout Mileage & Timeline Exporter sends Takeout place IDs to Google Places API when you translate locations.

GreenGuard redirects visits to some merchant sites through affiliate tracking links.

Groupboss stores backend auth tokens and optional saved login passwords with a hardcoded encryption passphrase.