Medium risk browser extensions

Wachete sends the active tab URL to www.wachete.com over cleartext HTTP when clicked.

Walmart Only No Third Party Seller sends Walmart list URLs through a Walmart affiliate redirect when clicked.

Wasubot lets WhatsApp page scripts read selected extension storage through its message bridge.

Wazo extension sends debug logs with account and server metadata to a remotely configured logging host.

WebP to JPG sends selected image files and image URLs to a conversion server over cleartext HTTP.

Whale - Product Importer sends AliExpress product-page URLs to dsreviews.net and injects the returned affiliate iframe.

WhatSender PRO sends URLs from outgoing WhatsApp messages to third-party link-preview servers.

Whiteboard inserts Heroku-hosted story media and link fields into UTD Blackboard pages without sanitizing them.

WordPress Theme Detector sends the active site's hostname and IP address to ip-api.com over HTTP.

WriteMe.ai reads REACT_TOKEN_AUTH tokens from pages and sends them to apiv2.writeme.ai.

Yog B2B sends support-ticket details to Airtable and login auth keys to Procbee while embedding API credentials.

Youtube Timestamp Saver stores saved video thumbnail URLs that the options page requests from YouTube over HTTP.

Zid Sway3 replays Rosetta Stone API requests with modified progress and lesson-completion values.

beta工具 fetches remote Alibaba tool config, calls configured URLs, and sends encoded responses back to beta.alibaba-inc.com.

dict.cc context menu sends selected page text to dict.cc over an unencrypted HTTP search URL.

html.tomake.design (llama) lets any website trigger a page DOM capture into a downloaded .h2fig file.

iTracker: IG Unfollower Checker uses vendor rules to make Instagram API requests with your session data.

midjourney to notion sends saved prompt details and subscriber identifiers to gpts-api.gpt-stores.com.

The extension sends Wildberries seller supplier phone numbers and IDs to mphero.io weekly.

The extension sends Wildberries supplier phone contacts and old IDs to plugin.mpstars1.ru.

obsidian-livesync-webclip sends clipped page content and saved CouchDB Basic credentials to a configured database URL.

screenshot-to-pdf injects a Cloudinary image into the active page after each screenshot capture.

Đánh giá nhanh - DTU captures the visible MyDTU tab and sends the screenshot to Google Gemini for CAPTCHA solving.

VPN for Claude supplies proxy credentials to sites that request HTTP authentication.

SkyBridge supplies its proxy credentials to website authentication challenges while the VPN is connected.

云神价-购物点点 reads Weibo account IDs from open tabs and sends them to www.yunshenjia.com.

友鹰数据(Extension) fetches server-selected JavaScript and runs it on marketplace pages.

智小抖 - 抖音AI全能助手 captures Douyin, Douhot, and Compass API responses and sends them to api.petslib.cn.

比特币行情 上班盯盘助手 sends bundled API keys to CoinGecko Pro and Mifengcha when fetching market and news data.

絶対に忘れないAI辞書 - ディクト sends DiQt API requests with an embedded Basic authorization credential.

锐达RCL-TK店铺运营AI助手 sends TikTok and Tokopedia seller cookies to twelve extension IDs every 30 seconds.

Simple Price Alerts loads affiliate tracking URLs on shopping pages and fetches remote boun.me rules that control page hooks.

AI Platform captures your app.scade.pro login session cookie and sends it to a third-party tracking server.

Android emulator MyAndroid reports every website you visit to its own server, once per day, keyed to a persistent per-install ID.

Nike MeaVana sends the IP Info utility's public IP lookup to ip-api.com over cleartext HTTP.

Yandex search by image sends the URL, title, and referrer of every page you visit to Google Analytics with a persistent per-install ID.

Translate Webpage stores original page text and URLs in each site's localStorage after translating HTTPS pages.

LinkedIn Video Downloader sends the user's signed-in Google account email to an unrelated third-party licensing server.

Euskalbar sends dictionary search terms to several configured sites, including cleartext HTTP endpoints.

FastProxy logs every site you visit and periodically sends the encoded browsing history to its own servers.

Idle Forest bundles the Mellowtel SDK, which loads pages in a hidden tab and sends their content to Mellowtel's servers.

Malus VPN sends the full URL and page title of every proxied tab to Google Analytics and its own backend.

iGive Button initializes PostHog analytics with autocapture on every page you visit, not just cashback merchant sites.

Vocabulary builder injects a remote vocabulary.live sidebar into any site, giving it read/write access to the page and its local storage.

Workstation for Discord has no local Discord client; every button loads a third-party site, winfy.net, to handle the Discord session.

EvenBetterRYM embeds Spotify and Tidal OAuth client credentials and sends them to token endpoints for music lookups.

Adobe Bulk Download sends Chrome account identifiers to a license server during startup license checks.

Discord Token Login signs into Discord from a pasted session token, writing it into local storage and skipping the password and 2FA prompt.

Автоотклики на HH — HeadHunter sends saved Telegram usernames to a TributeManager access-check API.

KittyCursor bundles GiveFreely affiliate code that runs on every page and reports the URLs you visit to events.givefreely.com.

Generates AI comment suggestions for LinkedIn posts based on the user’s profile, tone, and settings.

Lockcard sends dictionary and translation requests to DeepSeek with a bundled API bearer token.

Friend Ejector reads your entire Facebook friends list and uploads it to its own backend server.

SL Sender bundles an affiliate SDK that watches every site you visit and opens background tabs to inject affiliate cookies when shopping.

WA Privacy reads your WhatsApp number and sends it with a persistent device ID to a third-party analytics endpoint on every logged event.

News New Tab routes search queries and news requests through third-party domains tied to a publisher affiliate key.

Flashing News & Search replaces the new tab page and routes all searches and news fetches through its own servers using a hardcoded publisher key.

GoGPT monitors every page you visit and can silently redirect your active tab based on a remote command.

FortiEDR Secure Browser reads the plaintext username and password from every form submitted on every site.