Medium risk browser extensions

Redmine Notification sends the user's Redmine API key to configured HTTP Redmine servers in URL query strings.

Reffer Lite App accepts remote crawl tasks and returns parsed page content to app-lite.reffer.ai.

Roketfy Etsy SEO sends Roketfy login credentials in a URL query string and includes a shared bearer token.

RollViewer - GordaoDAORA reads your Steam ID on CSGO-Skins pages and sends it to RollViewer's API for subscription checks.

SERP Analyzer sends broad browsing telemetry to data.tinycms.xyz with a persistent UUID.

Safari New tab sends logged-in Google profile details to Mixpanel and syncs saved tab history to sfnewtab.ashusharmadev.com.

Scaler++ syncs Scaler profile, contact, and performance details to scalerbackend.vercel.app.

Scope Health lets its sidebar capture EHR page HTML, form fields, and matched API traffic on supported EHR sites.

Scouter sends language-learning prompts to OpenRouter by default and uses Azure Speech for text-to-speech.

Search Tool (AI) sends matched history and bookmark domains to icon.horse when showing popup suggestions.

Searcher for Discogs sends selected artist, style, and track metadata to Google Analytics.

Send 2 Photopea sends selected page image data and URLs to Photopea using generated Photopea script commands.

Shop Deals sends Google search result URLs to Takeads and rewrites eligible results to affiliate links.

Shop Mail reads cart item details from shopping pages and sends them with the page URL to its coupon API.

Shopflo Operator lets Shopflo's remote config set Shopify app OAuth scopes and reports merchant workflow activity.

SiaBot - Siaep MA sends SIAEP school, user, class, and worksheet row counts to a Google Apps Script endpoint.

Siap Dips sends Moodle quiz content to AI endpoints and can rewrite a Safe Exam Browser attestation header.

Slack Printer sends Slack page URLs, titles, and browser interest cohort data to slackext.com analytics.

Smart Video Downloader fetches remote network rules that can modify browsing requests across all sites.

Smm-helper fetches remote GitHub news settings that can inject JavaScript into VK pages.

Social Toolkit stores the user's login password in extension localStorage before login succeeds.

Sparkly exposes tab, history, and Workspace search metadata to pages while its search overlay is open.

Speed Whats Sender sends WhatsApp login passwords in API URLs and stores credentials in web.whatsapp.com localStorage.

Spoke initializes PostHog on Meet and Spoke pages and can upload page telemetry and session snapshots to CloudFront.

Sport background pictures new tab sends new-tab search queries to rotating third-party feed domains.

Spotify to Apple Music Playlist Converter stores an Apple Music user token in Spotify localStorage for about six months.

StreamFab Video Downloader sends cookies from the active non-YouTube site to its native companion app.

StreamSpeed can disable Russian-language pages and play looping remote audio after its toolbar button is clicked.

TOTP Authenticator stores and exports saved authenticator secrets in plaintext.

TS3MusicBot WebStream sends tab audio, page details, and saved webinterface passwords to user-configured bot hosts.

Taobao Helper sends popup search terms to ai.taobao.com over cleartext HTTP.

Temora sets itself as the default search provider and sends search and usage telemetry to fwsrc4you and Temora endpoints.

Automatically applies coupon codes at checkout for participating online stores.

Text to MP3 sends selected page text to its synthesis API and can include user API keys in Sentry tracing.

TikTok Ads Balance & Top Up TikTok Ads stores remembered login passwords in extension localStorage.

TikViral stores the extension account profile in TikTok-origin IndexedDB.

Tipli reads selected page text and sends it with the page URL to www.tipli.hr when its remote feed matches a site.

Tipli: Cashback nagrade in kuponi uses remote feed rules to scrape matching pages and sends selected text to Tipli.

Tippin Extension (tippin.me) sends Twitter usernames and tweet IDs with a hardcoded API credential to api.tippin.me.

Toggle X records clicks, non-password form input, page URLs, and full page text from websites and sends them to x.toggle.pro.

The extension sends selected English words to Youdao over HTTP when pronunciation audio plays.

TuffBlocker sends supported shopping and Google page URLs with an install identifier to api.weberowsky-yt.workers.dev.

Twitch Auto Bonus sends channel bonus-claim events with a persistent install ID to apiget.ru.

Twitter Enhanced sends saved Twitter/X remarks and usernames to Google Analytics when remarks are used or updated.

Typster stores your OpenAI API key in Google Docs page storage and sends it to OpenAI for AI typing features.

UFC Calendar embeds an API credential and sends it to its AWS event API.

UTurbo sends the active tab URL and browser user agent to carbonvpn.tech when its popup opens.

Ultimate Office Tools sends new-tab search queries to f.frequentvisitor.com with a hardcoded affiliate token.

Unicode Analyzer sends selected page text as codepoints to an i18n-cloud.appspot.com HTTP endpoint.

Unify stores OAuth access and refresh tokens using an encryption password bundled with the extension.

UserAdvocate sends embedded UXArmy API credentials in headers on test API requests to app.uxarmy.com.

UserVoice Feedback Capture captures full page text and email addresses from every site into extension messages.

Velocity sends signed-in users' ChatGPT, Claude, and Gemini chat transcripts to ThinkVelocity ContextEngine.

Vimeo Video Downloader sends embedding-site cookies to Vimeo when fetching embedded video config data.

Vindy sends Vinted draft-debug reports with listing and user details to a hardcoded Discord webhook.

Visibrow sends active and completed tab URLs to its categorization endpoint.

Visualizzatore file fprg sends invalid Flowgorithm file contents to Google Analytics when parsing fails.

Vysor Web Capture stores the user's raw Vysor password in extension-local storage for automatic reauthentication.

WASendBulk sends WhatsApp profile details, page telemetry, and outgoing links to Google Analytics and backend services.

WPoptic sends your Chrome profile email to api.wpoptic.com and reports WordPress site URLs and detected technologies.