Medium risk browser extensions

Email Extractor collects email addresses from visited pages and sends batches to mailshunt.com.

楽天ウェブ検索 sends batches of visited URLs, referrers, redirect chains, browser details, and a Rakuten cookie to Rakuten.

Font Changer rewrites shopping links and queries deals99.com for affiliate promotion URLs.

Quest PDF sets itself as the default search provider and sends search and suggestion terms to QuestPDF and Yahoo endpoints.

Search Engines Helper sends user-created search engine definitions to http-request-echo-server.onrender.com.

YouTube Adblocker injects a hidden remote iframe from modal.style on every website after an eight-hour delay.

Gaming News Feed sends new-tab search terms to bethegamepro suggestions and submitted searches to Yahoo.

oneClipper oneNote web clipper sends page or selected content to Google Gemini for AI clipping features.

.parse(Hub) sends selected Blip Desk ticket contact details to DeskSalesAI when a chat ticket is selected.

360 Ribbon fetches remote EHR rules that execute JavaScript while reading patient names and dates of birth.

ASUS Download Master Chrome Extension sends router login credentials to its default HTTP router endpoint.

AceConnect IN stores encrypted auth tokens using a hardcoded password bundled in the extension.

Ad Dimmer fetches remote rules from addimmer.com that can inject page-context scripts on visited sites.

Agency Dashboard SEO Extension sends the current site's domain to APILayer and WhatCMS from its popup tools.

Agent Quick Tools rewrites shopping-agent product and registration URLs with its own affiliate codes.

Aionda Mail sends classic login credentials and session IDs to mail.aionda.com in URL query strings.

Ali Hunter sends AliExpress product URLs to a Glitch service and rewrites AliExpress pages through affiliate links.

Ali Hunter rewrites AliExpress product and cart visits through affiliate links.

AliExpress & Alibaba Dark Mode forwards clicked shopping URLs to alitems.link affiliate redirects.

AliSave redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliVoice redirects matching AliExpress pages through affiliate deep links and sends the page URL to alisavetools.com.

Alibaba, AliExpress & 1688 Search by Image redirects matching product pages through rzekl.com affiliate links.

Aliexpress image downloader redirects AliExpress item, cart, and order pages through s.click.aliexpress.com.

Amazon Prime Subtitles & Dictionary adds your email and last watched Amazon URL to its uninstall URL.

App Studio sends popup search and download activity with a persistent install ID to an n8n webhook.

Apple Music(iTunes) Web Player sets Chrome searches to chromecrxstore.com and sends omnibox search terms there.

Atomic Fusion stores its login token in Bubble page cookies that host-page scripts can read.

Authenticator stores TOTP enrollment secrets using a hardcoded fallback key when access-key encryption is off.

Auto Answer Edunext sends captured EduNext authorization headers to chat.ptudev.net during user-ID lookup.

Auto BCC for Gmail sends saved Auto BCC rules and cached Gmail sender choices with support requests.

The extension sends Slack message text to translate-api.ext-api.com over plaintext HTTP for DeepL/GPT translation.

Basket records page-load, unload, and click telemetry on server-selected sites and sends it to its API.

Bing Maps Leads Scraper places Google OAuth access and refresh tokens in its Mapleadscraper pricing page URL.

Bookface Companion sends Gmail thread participant email addresses to Bookface when Gmail conversations load.

Bookmark Preview sends bookmarked page URLs to Google favicon service when rendering bookmark previews.

BudgetBuddy sends new-tab search terms to suggestion and search redirect domains.

Calculator Extension sends searches typed on its new-tab page to brownmile.com.

CheckFlow Browser Relay can attach its local debugger relay to sites saved in its own blocklist.

Ciphix Mendix dev tools saves Mendix passwords and bearer tokens in page localStorage as plaintext.

Claude2PDF sends the active Claude page HTML to www.aihuoji.com when exporting a conversation to PDF.

Clifl reads YouTube page data and account identifiers during server-directed viewing tasks.

Cookie Decliner sends visible page text and the current URL from every HTTP(S) tab to carmesin.me.

Coursera Summary with ChatGPT and Take Notes signs NoteGPT API requests from bundled extension credentials.

CovidDash at Johns Hopkins University replaces browser search, homepage, and startup settings with coviddashboard.extjourney.com.

Cricket Score Bar inserts Cloudinary-hosted score images into every tab after a match is selected.

Ctrl+Tab MRU inserts current-window tab titles and tab IDs into the active webpage DOM.

The extension sends shopping-page product details and product links to Gobiz and Sabomall services.

Deep Enrich sends LinkedIn profile URLs to app.deepenrich.com before its consent dialog is accepted.

Definio AI can send selected page text, screenshots, and account identifiers to Definio and analytics endpoints.

Easy Calendar Plan inserts vendor API responses into Google Calendar without escaping them.

Email Extractor reads page HTML and can store email addresses from every visited site when auto-save is enabled.

Emat Smash - Hack til Emat uploads Grammatip result-page HTML and student identifiers to skolesnyd.byethost17.com.

FUT Alert - My Extension lets EA/FUT and FUT Alert pages read saved local storage and send imported club holdings to futalert.co.uk.

Flowchart Maker requires first-run survey answers and an email address, then sends them to quiz.swimming.run.

Freshy Recipes can send your Chrome top-sites list to its remote new-tab page.

Galaxy Creatures sends new-tab searches with persistent extension identifiers to search.galaxycreature.net.

Generate Strong Password creates passwords with Math.random when you use its editable-field context menu.

Geometric Structures sends new-tab searches with persistent IDs and displayed bookmark URLs to external services.