Medium risk browser extensions

Tube Transcripts reads YouTube cookies and sends them to its Cloud Functions when used in YouTube Studio.

HCOS auto deletes browser history URLs with broad search-query markers after Google search activity.

Happy Cat sends your Chrome profile email and stable profile ID to api.tuhocvangioi.com when its new tab opens.

HappyDoc Chrome Extension forwards eVetPractice tokens and appointment data to HappyDoc API endpoints.

Heart Exchanger for Etsy can send raw Etsy page HTML back to its WebSocket service during remote tasks.

Huboh AI fetches server-assigned URLs with browser credentials and sends extracted page content to gateway.huboh.cloud.

HumanLetter sends Gmail message content and metadata when it detects hidden tracking images.

IExtension accepts login bearer tokens on plaintext HTTP SSO redirect URLs.

Infigrowth SEO Extension sends the active tab URL to Google SEO and Chrome UX Report endpoints when its popup runs.

Instant Multilingual PDF/HTML/TXT Dictionary can send selected password-field text to its translation provider.

Jotit stores user-entered two-factor authentication secrets in Chrome sync storage without encryption.

KJV Simple Search Parallel Bible App sends selected or omnibox Bible search text to dailywordofgodgroup.com over HTTP.

Kwanko toolbox sends failed-login API keys to Google Analytics as an event label.

Land Insights Toolkit sends LandPortal account, billing, subscription, and cancellation data to api-landportal.vercel.app.

Landing Page Ripper sends your Chrome profile email and captured page URLs to track.landingpageripper.com.

Leads Connect sends Instagram account IDs to app.socialeai.com when country or gender filters are used.

Les bons Plans remises & Cashback FLOA sends recognized merchant visits to Google Analytics with a persistent extension client ID.

Link Unshortener sends matching shortened-link navigation URLs to linkunshorten.com through redirect rules.

Locker protects cloud-synced private bookmarks with an encryption secret bundled in the extension.

London Background Pictures New Tab sends searches typed on its new-tab page to feed.yeshlasearch.com.

Lovable Code Downloader reads JWT session tokens from Lovable pages and stores cookie tokens in extension storage.

Lystos en tu portal - ES sends the full Registradores page HTML to services.lystos.com when registry results change.

MYBEST代购代运助手 sends parcel form details to MYBEST over cleartext HTTP.

Macro Settings by FOODFASTFIT lets an HTTP site set macro goals that it later posts to MyFitnessPal.

Magic Extension sends active-tab URLs, page titles, and input-activity counts to the Magic web app.

Mais e-Sports Descontos sends matched shopping-page URLs and extracted page values to descontos.maisesports.com.br.

MathGPT uploads user-selected screenshot regions and sends the resulting image URL to its solving service.

Mazepool exposes typed license keys to Facebook Ads Library page scripts and sends them to Gumroad for validation.

Mega Messenger periodically reads Facebook friends' birthdays and sends the birthday list to next.cloudki.io.

Mochimo Wallet sends wallet API requests to a built-in Australia mesh provider over cleartext HTTP.

MyQ X Chromebook Client sends OAuth client registration and token traffic to the configured print server, including over HTTP.

Name Generator retrieves generated password material from randomprofile.com over cleartext HTTP.

Nature background pictures new tab sends new-tab search terms to direct.searchontop.com with publisher identifiers.

Neatly derives the account password it sends to its API from the signed-in Chrome profile email and ID.

Nectar for Whats stores the Nectar CRM access token in WhatsApp Web localStorage with reversible encoding.

NetflixProxy sends login credentials and account tokens in URL query strings to nf.startapi.win.

NewTab新标签页 fetches JavaScript-like instructions from api.newtab.com and runs them on its new tab page.

Neymar Jr MeaVana embeds a Google Translate API key in its shipped translation utility.

Numintec for Chrome stores account passwords in chrome.storage.local and sends login credentials to InvoxContact.

Offsite - Save to monday.com ships hardcoded API and OAuth secrets used in AddOffsite and monday.com requests.

Open Bookmarks in New Tab rewrites some Google, Microsoft, and Baidu bookmarks through a GitHub Pages redirect.

OpenBnB identifies your Chrome profile email to PostHog when the extension is installed.

OutX imports Supabase code from esm.sh into its background service worker at runtime.

Over.fig forwards Figma overlay project data into the active web page.

PDF Clipper sends new-tab search queries and affiliate parameters to find.vplay-fuel.com.

PDF Converter sends searches typed on its new-tab page to find.digital-marketing-ads.com.

PaperSpan opens its list page with the stored access token in the URL query string.

Paragraph Rewriter sends selected or typed text and prompts to api1.lightdragon.club for rewriting.

Paris Background Pictures New Tab sends typed new-tab searches to random feed domains.

Phantom: Lofi Tutor sends selected saved chat text to an AWS Polly demo page for voice playback.

Pomodoro Timer for Google Calendar sends Google Calendar event titles to Google Analytics when a user starts a timer.

Poplingo removes frame-protection headers from subframe responses while its link preview is open.

PremierLeague Stats sends new-tab search terms to prls.premierleaguestats-ext.com with a tracking ID.

Privacy Guardrail can send stored original text back to supported AI chat pages through its clipboard restore flow.

Proboost Vocpro embeds a DashScope API key and sends DeepSeek chat requests to Alibaba's DashScope API.

Prodigy Hacking Extension | X Loader fetches and runs remote Prodigy hack code on Prodigy game pages.

Prompt Viewer renders extracted image metadata into the page DOM after you use its context menu.

RSA Test Finder sends saved email addresses and driving-test slot alerts to SMTP2GO.

Recipe Reader & Grocery Finder sends encoded Amazon Fresh recipe ingredients to cerescart.com over HTTP.