Medium risk browser extensions

Gramatika includes a recoverable Katla API authorization token in its shipped popup code.

Grok AI sends sidebar chat messages to Together's chat-completions API using an embedded bearer key.

HD, Replay, Popout for YouTube sends popout video embed URLs to uslocaltv.appzend.net.

IPTV Tools can send Xtream IPTV usernames and passwords over HTTP when users enter an http:// server URL.

In Private Mode uses a hidden pinned Google tab to run backend-directed searches and report visited result URLs.

In-Page Piano Analytics lets active pages request and receive Piano Analytics article metrics.

Iris Wallet sends JSON-RPC requests to Nockblocks with a bundled API key.

Kabila Wallet sends wallet identifiers and an embedded HSuite API key to HSuite swap gateways.

Kondor encrypts wallet seed phrases and imported private keys using the same stored AES-GCM IV.

Language Learning with YouTube-AFL signs AI coach requests with an embedded secret and opens Apple sign-in over HTTP.

LeadContact sends the URL of every page you visit to its own servers once you enable its 'browse everywhere' feature.

Learn Helper stores auto-login credentials reversibly in local browser storage with a hardcoded XOR key.

LibreOffice Impress online sends each top-level navigation URL pair with a persistent identifier to runapps.org.

LiftmyCV sends full job-application page HTML to app.liftmycv.com when autofill errors occur.

LinkMatch for HubSpot captures LinkedIn profile, contact, inbox, Sales Navigator, and Recruiter responses and sends them to LinkMatch.

Lock Your History stores its history-lock password and hint in plaintext browser sync storage.

Lookup - Website Profiler sends page HTML and URLs from visited sites to joinlookup.com when remote lookups need more data.

Lucky VPN & Proxy embeds a ProxySeller API key and uses it from the popup to retrieve proxy inventory.

Macify sends optional weather keys and city to WeatherAPI over HTTP and sends top-site origins to Google's favicon service.

MagickPen - ChatGPT Writing Assistant sends requests to api.magickpen.com with reusable signing secrets in its bundle.

Magnifying Glass places captured screenshots into the page DOM when a user activates its magnifier.

MailMagic reads Gmail thread bodies when you open a conversation and sends the content to app.mailmagic.ai.

Materio Selection Clipper sends user identity and clipper API traffic from its side panel to LogRocket.

Mermaid Graphical Editor exposes cached diagram text to the active page when you open its editor.

IG DM Sender stores your Instagram CSRF token in exported issue logs using reversible encoding and a bundled default key.

Minty Adblocker sends visited page URLs to Minty's merchant API after top-level page loads.

Modulr Wallet polls account state and submits signed transactions to hardcoded Modulr RPC endpoints over HTTP.

MultiVis Meeting sends meeting tokens and screen-sharing data over cleartext HTTP and WebSocket connections.

My world clock redirects new-tab search queries to search-it.cc with affiliate parameters.

Neat Tab sends new-tab search terms to its search servers with persistent install identifiers.

NewsWhip by Sprout Social sends its stored auth key to Google Analytics as the client ID on popup click events.

Next Pointer redirects Google search pages to npext.com and forwards the user's search query.

NotebookLM EDU Enhancer(TW) stores an AI Studio API key in NotebookLM page storage and exposes note text to parent frames.

Number Checker for WhatsApp sends typed WhatsApp message URLs to third-party link preview services.

Office Tools sends searches typed on its new-tab page to find.digital-marketing-ads.com.

OneClick sends LinkedIn profile details and email address to PostHog after reading LinkedIn cookies on job and feed pages.

OneNav sends each displayed saved bookmark URL to favicon.png.pub when loading favicons.

OpenSubtitles for Netflix stores OpenSubtitles login credentials in Netflix page localStorage.

OpenWardrobe sends the current page URL to affiliate redirect services when you click its toolbar or hover-save controls.

PACify | The Proxy Manager fetches user-configured PAC files and applies them to Chrome proxy settings.

Pangeo sends account passwords in GeoEdge API URL paths during login and user-agent refresh.

Perplexity to obsidian - Batch Export sends export telemetry with conversation URLs, titles, client ID, and email to cf-node-api.aluo.app.

Postlight Reader uses remote rules to place full-page browser-download overlays on popular websites.

Product Search sends visited page URLs to apiheaven.io and can redirect tabs through apiheaven.io/pulse.

QR Code Scanner and Generator writes scanned QR text and a camera still into page-readable DOM on every site.

ReadLite posts selected text and highlight notes from reader mode to the host page.

Reflektive sends Gmail account and conversation metadata to its Reflektive web app.

Roblox Characters Custom Cursor loads selected cursor images from allcursor.com on pages you visit.

Robô de Comentários - Bot de Sorteios sends Instagram profile details, location, and device data to botsorteios.com.

SNDL opens its login page with saved credentials and the active tab URL in the address bar.

Safe Search Engine sends new-tab search terms to server.taskticks.com before opening Google SafeSearch.

Salvage Auction Research Tool sends auction page HTML and protected auction records to AuctionHunter.

SamuMoa stores the OBS PeerJS connection key in marshmallow-qa.com's page storage.

Search by image on Ebay sends visited page URLs to apiheaven.io and may redirect browser tabs from remote config.

Self Messenger sends your WhatsApp number to Google Apps Script and an HTTP quota endpoint.

Smart Fiverr sends Fiverr account details, including email and name, to Mixpanel during login and account changes.

SnapGen Flow imports remote GitHub selector settings that guide its Google Labs Flow page automation.

Somiibo redirects shopping and rewards sites through hardcoded affiliate/referral links.