Medium risk browser extensions

Font Changer rewrites shopping links and queries deals99.com for affiliate promotion URLs.

Search Engines Helper sends user-created search engine definitions to http-request-echo-server.onrender.com.

YouTube Adblocker injects a hidden remote iframe from modal.style on every website after an eight-hour delay.

oneClipper oneNote web clipper sends page or selected content to Google Gemini for AI clipping features.

.parse(Hub) sends selected Blip Desk ticket contact details to DeskSalesAI when a chat ticket is selected.

360 Ribbon fetches remote EHR rules that execute JavaScript while reading patient names and dates of birth.

ASUS Download Master Chrome Extension sends router login credentials to its default HTTP router endpoint.

AceConnect IN stores encrypted auth tokens using a hardcoded password bundled in the extension.

Ad Dimmer fetches remote rules from addimmer.com that can inject page-context scripts on visited sites.

Agency Dashboard SEO Extension sends the current site's domain to APILayer and WhatCMS from its popup tools.

Agent Quick Tools rewrites shopping-agent product and registration URLs with its own affiliate codes.

AiPrice reports matched browsing URLs to api.aliprice.com based on remote rules.

Aionda Mail sends classic login credentials and session IDs to mail.aionda.com in URL query strings.

Ali Hunter sends AliExpress product URLs to a Glitch service and rewrites AliExpress pages through affiliate links.

Ali Hunter rewrites AliExpress product and cart visits through affiliate links.

AliExpress & Alibaba Dark Mode forwards clicked shopping URLs to alitems.link affiliate redirects.

AliSave redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliVoice redirects matching AliExpress pages through affiliate deep links and sends the page URL to alisavetools.com.

Alibaba, AliExpress & 1688 Search by Image redirects matching product pages through rzekl.com affiliate links.

Aliexpress image downloader redirects AliExpress item, cart, and order pages through s.click.aliexpress.com.

Amazon Prime Subtitles & Dictionary adds your email and last watched Amazon URL to its uninstall URL.

App Studio sends popup search and download activity with a persistent install ID to an n8n webhook.

Apple Music(iTunes) Web Player sets Chrome searches to chromecrxstore.com and sends omnibox search terms there.

Atomic Fusion stores its login token in Bubble page cookies that host-page scripts can read.

Authenticator stores TOTP enrollment secrets using a hardcoded fallback key when access-key encryption is off.

Auto Answer Edunext sends captured EduNext authorization headers to chat.ptudev.net during user-ID lookup.

Auto BCC for Gmail sends saved Auto BCC rules and cached Gmail sender choices with support requests.

The extension sends Slack message text to translate-api.ext-api.com over plaintext HTTP for DeepL/GPT translation.

Bing Maps Leads Scraper places Google OAuth access and refresh tokens in its Mapleadscraper pricing page URL.

Bookmark Preview sends bookmarked page URLs to Google favicon service when rendering bookmark previews.

BudgetBuddy sends new-tab search terms to suggestion and search redirect domains.

Calculator Extension sends searches typed on its new-tab page to brownmile.com.

CheckFlow Browser Relay can attach its local debugger relay to sites saved in its own blocklist.

Ciphix Mendix dev tools saves Mendix passwords and bearer tokens in page localStorage as plaintext.

Claude2PDF sends the active Claude page HTML to www.aihuoji.com when exporting a conversation to PDF.

Clifl reads YouTube page data and account identifiers during server-directed viewing tasks.

Cognism - Sales Intelligence Extension embeds a DataStax Langflow bearer token and sends AI prompt input to DataStax.

Cookie Decliner sends visible page text and the current URL from every HTTP(S) tab to carmesin.me.

CovidDash at Johns Hopkins University replaces browser search, homepage, and startup settings with coviddashboard.extjourney.com.

Cricket Score Bar inserts Cloudinary-hosted score images into every tab after a match is selected.

Ctrl+Tab MRU inserts current-window tab titles and tab IDs into the active webpage DOM.

The extension sends shopping-page product details and product links to Gobiz and Sabomall services.

Decopy AI sends YouTube video IDs and summary inputs to api.decopy.ai with a persistent device identifier.

Deep Enrich sends LinkedIn profile URLs to app.deepenrich.com before its consent dialog is accepted.

Definio AI can send selected page text, screenshots, and account identifiers to Definio and analytics endpoints.

Easy Calendar Plan inserts vendor API responses into Google Calendar without escaping them.

Emat Smash - Hack til Emat uploads Grammatip result-page HTML and student identifiers to skolesnyd.byethost17.com.

FUT Alert - My Extension lets EA/FUT and FUT Alert pages read saved local storage and send imported club holdings to futalert.co.uk.

Flowchart Maker requires first-run survey answers and an email address, then sends them to quiz.swimming.run.

Free VPN Premium for Chrome - OnVPN sends each completed top-level navigation URL to www.runapps.org with a persistent user ID.

Freshy Recipes can send your Chrome top-sites list to its remote new-tab page.

Galaxy Creatures sends new-tab searches with persistent extension identifiers to search.galaxycreature.net.

Gaming News Feed sends new-tab search terms to bethegamepro suggestions and submitted searches to Yahoo.

Generate Strong Password creates passwords with Math.random when you use its editable-field context menu.

Geometric Structures sends new-tab searches with persistent IDs and displayed bookmark URLs to external services.

Google Meet Transcription uploads meeting transcripts to a remote AI summarization service.

GptAutoBOT sends /gpt prompts typed in page inputs, including sensitive fields, to ChatGPT.

Gradient Blobs sends rendered bookmark URLs to Google's favicon service on its new-tab page.