Medium risk browser extensions

CG No Login Master runs its popup script on every website visited, sending the page's origin and the user's IP to its vendor's server.

Xooma Intelligence Disconnector reads your entire Facebook friend list and sends it to its own servers.

OfferAhead sends your live ChatGPT access token to its own server every time you open the popup.

Trello Task Creator routes your full-access Trello token through a developer-owned webpage instead of Chrome's secure OAuth callback.

Find Real Friends reads the full text of your ChatGPT conversations and sends them to its own server.

Apollo Tab sends new-tab searches to its own server tagged with a persistent per-install ID instead of your default search engine.

Clean for LinkedIn hands its own web app your LinkedIn session cookie on request.

WealthPipe sends the full URL of every site you visit or switch to to its own server, with no opt-in.

FortiEDR Secure Browser reads the plaintext username and password from every web form you submit, on any site.