Medium risk browser extensions

Mercado Livre TrueSort fetches affiliate-link rules from bembarato.org and rewrites matching links on pages you visit.

Motorcycles Wallpaper sends searches typed on its new tab page to lsrcunow.com.

NoteTab - Save Your Thoughts sends new tab search queries and saved bookmark domains to external services.

Ogame Fast expeditions fetches and runs remote code from kds-tools.com on OGame game and lobby pages.

Omni Convert redirects default omnibox search queries to find.madmidas.net monetized results.

Pocket Prompt sends prompt context and account email to its API when users run a prompt.

Porto sends tweet archive link URLs to third-party preview and proxy services while building Bluesky embeds.

Prompt Engine Pro stores its API token as a page-readable cookie on ChatGPT pages.

PureTwitter sends X account block-list telemetry to puretwitter.ikeyly.cn over cleartext HTTP.

Quick Text Extraction writes OCR text from selected screenshots into the page DOM.

R Discovery: Academic Research sends article metadata to R Discovery and posts CleverTap analytics with a bundled upload passcode.

RSS Subscription Extension, Reader sends selected RSS feed URLs and reader options to rssmerge.flowsoft7.com over HTTP.

RankNow.ai fetches setup data from extension.ranknow.ai and inserts it into ChatGPT page HTML.

Recapio: AI Youtube Summarizer automatically sends YouTube watch URLs to Recapio's API for transcript/chat processing.

Safeguard Enterprise Password Vault opens its vault web UI with the bearer token embedded in the tab URL path.

Saturation Scout sends product-page URLs, matching store domains, and product image data to external services.

ScreenTime sends tracked website hostnames to Google's favicon service when its popup displays usage history.

Search by image on Alibaba sends visited URLs to apiheaven.io and can redirect a background tab from server-provided links.

SeoLift uses a plaintext seolift.pro control channel to inject ad overlays and open or redirect tabs after user activity.

The extension builds share links that send the active tab URL and title to multiple sharing services, some over HTTP.

Sharkdropship ships a recoverable API key used for license validation.

Shein Images Downloader sends signed-in account profile and subscription details to Mixpanel analytics.

Smart Color Picker and Palettes places visible-tab screenshots into pages during picker mode.

SnapThePrice opens a hidden affiliate redirect that includes the active tab URL.

StarNgage Instagram Profile Analyzer sends login emails and passwords to api.plus.starngage.com in a URL query string.

Stellar Mod For Slither.io sends saved team and tag passwords to scripts on slither.io and slither.com pages.

Swiggy Zomato Blinkit Spends sends active-tab Blinkit token values to Blinkit order-history endpoints.

Synclify sends video-detection failures with the full page URL and a persistent analytics ID to its API.

TrackWapp Online Monitor records WhatsApp Web contacts' online sessions and sends them to trackwapp.online.

TradeSage redirects TradingView script bundles to tradesage.co and loosens TradingView's CSP.

Trust.Zone VPN Proxy sends account passwords to robocloud.top in a login URL query string.

TubeX.Chat places the saved LLM API key into a password field in the YouTube page DOM while settings are open.

Tubi Speeder sends Tubi profile identifiers, continue-watching history, and playback events to me3x.online.

Turbo Stream routes most browser traffic through 72.56.50.29:43799 when its Server 4 proxy option is enabled.

URIRANK - Alexa Traffic Rank sends each top-level navigation URL to urirank.com.

Video Downloader rewrites response headers for MP4 files and requests from noname.technology.

Video Editor by DriveEditor.com sends Google account emails in Google Analytics events from Drive pages and the editor.

Virat Kohli MeaVana removes anti-framing headers when it loads third-party integrations in extension iframes.

WA Quick Group sends generated WhatsApp group invite links to third-party link-preview services during invite messages.

XPLA GAMES Wallet broadcasts wallet address changes to every open web page where its provider is injected.

Yoko Networks Click to Call supplies saved phone credentials to HTTP auth challenges from any website.

Zabbix Vue can send Zabbix passwords or API tokens to user-configured HTTP API endpoints.

eBextractor sends eBay purchase-history page HTML and page cookies to wcawasa.pythonanywhere.com when local parsing fails.

ideaocam makes camera media uploaded to Google Drive readable to anyone with the link.

multiAccounts modifies subframe headers to remove CSP and X-Frame-Options after site access is granted.

nDocuSoft sends NREGA workflow URLs with stored Digest values over cleartext HTTP.

x_Wallet uses PostHog flags to select wallet storage records and sends queued wallet_diagnostics data to PostHog.

Яндекс Вордстат Extension sends XMLProxy API keys and keyword queries to xmlproxy.ru over plaintext HTTP.

BlackJack 3D sends popup game identifiers to mines.cloudapi.stream and uses the response to control game behavior.

Debrid-Link Plugin exposes link metadata in page DOM and lets HTTP(S) pages trigger notification actions.

Qui-Quo fetches server-selected content scripts and hot-patch code that can run on any site.

Imagus mod runs auto-updated remote sieve rules as code on every site.

[Unofficial] Saladict - Pop-up Dictionary sends selected text to Baidu translation and speech endpoints over HTTP.

InteractiveFics writes saved replacement values into matching pages where site scripts can read them.

Magnifying Glass (Hover Zoom) places a captured screenshot of the visible tab into the current page DOM.

Email Extractor collects email addresses from visited pages and sends batches to mailshunt.com.

V3 - Get Old YouTube Layout fetches JavaScript from vorapis.pages.dev and injects it into YouTube pages.

ABV Notifier stores ABV account passwords in browser storage in a form recoverable with nearby stored data.

楽天ウェブ検索 sends batches of visited URLs, referrers, redirect chains, browser details, and a Rakuten cookie to Rakuten.

Quest PDF sets itself as the default search provider and sends search and suggestion terms to QuestPDF and Yahoo endpoints.