Medium risk browser extensions

SamuMoa stores the OBS PeerJS connection key in marshmallow-qa.com's page storage.

Records browser tab audio, microphone audio, and screen activity from the browser.

Search by image on Ebay sends visited page URLs to apiheaven.io and may redirect browser tabs from remote config.

Self Messenger sends your WhatsApp number to Google Apps Script and an HTTP quota endpoint.

Smart Fiverr sends Fiverr account details, including email and name, to Mixpanel during login and account changes.

SnapGen Flow imports remote GitHub selector settings that guide its Google Labs Flow page automation.

Somiibo redirects shopping and rewards sites through hardcoded affiliate/referral links.

Speed Dial Dogs sends new-tab search text to addonsearch.net and Bing.

Supercharge for Bolt.new embeds API keys and sends scrape and search requests to Firecrawl and 21st.dev.

Support with Mellowtel joins a Mellowtel WebSocket worker that can upload page URLs and HTML from all sites.

TEMU Hide Local Products fetches rules from iltekin.com that can alter Temu pages and add affiliate parameters to Temu URLs.

TYNA reuses saved manual proxy credentials for every browser authentication challenge while the proxy is active.

TabMetrics sends new-tab telemetry and search input to tracking and search services from its replacement new-tab page.

Tarss reads every linkedin.com cookie, including the HttpOnly li_at session token, and sends it as the Authorization header to api.tarss.fr.

TheChannel Viewer for Gmail posts embedded-page URLs, titles, and engagement activity to parent frames.

Time Limit loads third-party JavaScript from cdn.muicss.com inside its extension popup.

Tokmate sends TikTok profile, search, video, account, and Ads API data to api.tokmate.com.

Travel Mapper sends saved activity names and source URLs to Amplitude analytics.

USAVisaSlot sends visa appointment dashboard screenshots and slot details to api.usavisaslot.com.

Udemy Downloader sends signed download and account-status requests to udemy-downloader-ext.vuvuive.org.

VPN Facebook fetches remote proxy rules that can replace its PAC script and route browser traffic through configured proxies.

VPN for Chrome by WizVPN sends encrypted browsing and referrer telemetry to wizvpn.net during page loads.

Velio collects Twitter/X, Reddit, and LinkedIn feed content and uploads it to api.requests.velio.co.

WA Blaster embeds a reusable bearer token for its CRM lead-update API in the installed extension package.

YouTube Watch Later Bulk Delete posts feature activity and a persistent user ID to youtubeshorts.ru.

ZKX Web3 Wallet sends a persistent instance ID and selected account address/balance to Ambire price requests.

Zima Nodes sends login credentials over HTTP when a ZimaOS address is saved without an HTTPS scheme.

aiApply copies job application inputs and generated AI output into Alibaba Cloud log events.

Avatar maker from photo sends its app.aimensa.com login cookie value to bot.izibit.net.

fubukicss-tool redirects and rewrites Figma application scripts using rules fetched from ecomfe.github.io.

repmafia.net tools rewrites referral cookies and shopping URLs on supported storefronts.

screenshot-to-pdf injects a Cloudinary image into the active page after each screenshot capture.

syncmarx uploads encrypted bookmark sync archives to the cloud using a bundled decryption key.

tb7.pl sends selected text or links and the current page's localStorage login value to tb7.pl when using its context menu.

text to speech ai sends app.scade.pro session cookie values to bot.izibit.net when that cookie changes.

The extension routes YouTube, Google and Telegram traffic through proxy servers listed in a remotely fetched configuration.

التحضير الذكي v3 injects remote JavaScript into scoped school, government, and WhatsApp pages and sends their URLs.

The extension sends page URLs, referrers, and browser fingerprinting telemetry to p.baoyueai.com during UI actions.

포인트백 for ADPICK sends visited page URLs to ADPICK's shopping-link endpoint when an ADPICK login or affiliate ID is present.

linkding extension sends active-tab URLs during opt-in precaching and can send API tokens over HTTP Linkding URLs.

Open In IINA injects page-controlled URLs into browser-executed JavaScript when opening media links.

Discord Token Login injects popup-entered token text into Discord pages through unsafely constructed script code.

AutoFormer+ stores visible form fields, including passwords, in each site's localStorage.

CardPointers X sends Bank of America SAMLResponse and RelayState values to ui-api.tripleup.dev during deals setup.

YouTube Comment Search sends YouTube video and search request details to a hosted YouTube proxy API.

URL Shortener sends saved Cutt.ly API tokens and long URLs to app.thebyteseffect.com when shortening links.

Superpower ChatGPT syncs ChatGPT conversation history and full conversation records to api.spchatgpt.com by default.

Pinned ChatGPT injects hidden affiliate iframes on whitelisted sites and sends the current site URL to trendupdeal.com.

Y2Mate sends YouTube download requests with browser-generated authorization tokens to meowing.ssstik.art.

InterSub reads your signed-in browser account email and registers an intersub.cc account with it, without a sign-up step.

YouTube Video Downloader injects a remote S3 script into every matched webpage.

Google Image Search Right Click opens a cleartext Google image-search URL containing the selected image URL.

Magic CSS fetches Sass compiler JavaScript from cdnjs and injects it into the active tab in Chromium browsers.

AdLock fetches remote filter rules that can inject server-supplied JavaScript into HTTP and HTTPS pages.

Tipli do prehliadača uses remote instructions to read matching page text and send it to Tipli's add-on API.

YouTube UnBlock nikolaevevge routes YouTube, Google, ChatGPT, Facebook, Instagram, and IONOS traffic through SOCKS proxies.

SnapTube MP3 for YouTube Music Download adds YouTube download links that send video URLs to snaptube.audio over HTTP.