Medium risk browser extensions

IG DM Bot rewrites Instagram framing protections and changes selected site cookies to SameSite=None.

Deal Search Pro makes dealsearcherpro.com the default search provider for address-bar searches.

DirectStayz sends Booking.com hotel page URLs to Plausible and can rewrite search-result links through Awin.

Discord Chat Exporter embeds unescaped Discord message content in saved HTML exports.

DocSend to PDF sends DocSend cookies and document details to docsend2pdf.co when a view page opens.

Dofus Translator fetches live GitHub translation maps and inserts their values into the current page as HTML.

Dropeex stores your account password and login token in Chrome sync after you sign in.

EE-Updation Filler loads remote Netlify scripts into government RCH health-data pages.

ESI eSIP Chrome Extension copies a PBX websession cookie into synced extension storage after login.

Easy Apply Automater saves LinkedIn Easy Apply answers in linkedin.com localStorage.

Easy SEO Extension sends Google scraping requests through ScraperAPI with a bundled API key.

EasyRelay lets its server trigger Amazon Relay API requests from relay.amazon.com and receive the responses.

EditAnyCookie fetches Netlify configuration that can show a full-screen notice on configured sites.

Elden Ring 4k Wallpaper HD HomePage sends new-tab search keywords to Google Analytics.

Email Sender Icons by cloudHQ sends Gmail account email addresses to cloudHQ during Gmail page loads.

English <-> Thai Dictionary sends typed and selected lookup text to Longdo endpoints over cleartext HTTP.

EvenBetterRYM embeds Spotify and Tidal OAuth client credentials and sends them to token endpoints for music lookups.

Extract Text From Picture sends AI OCR screenshots and uploaded images to 158.160.66.115 over plaintext HTTP.

Fashion Background Pictures New Tab sends new-tab search queries to feed.mambosearch.com with publisher and barcode IDs.

Fastcup Helper includes a FACEIT bearer token in requests from its content script.

Fat cat screenshot routes Chrome update checks through agency.pictureknow.com when its update test fails.

Fiyat Geçmişi sends Trendyol product, search, coupon, and add-to-basket details to tyol.refinementpoker.online.

Flip YouTube and turn youtube video sideways sends YouTube page URLs and video IDs to analytics.wrongorbit.com.

Flow VPN sends login credentials through an encrypted API wrapper whose hardcoded key ships in the extension.

FoxTransfer sends store credential validation details to Foxify with a reusable private API key embedded in the extension.

Free Bulk Sender for Messenger sends WhatsApp bulk-message task details and AI prompts to vendor endpoints.

GOAT - AI Summaries reads page text from visited sites and sends it to a Vercel API after install.

GPT帮我翻译 sends selected text to OpenAI or ChatGPT and stores a ChatGPT session cookie in synced extension storage.

GemFold renders saved Gemini folder and chat links into the active page when its toolbar button injects the sidebar.

Geocaching.com Google Drive Notes stores a Google Drive OAuth token in geocaching.com page localStorage.

Global Gym Software SMS Sender sends the WhatsApp login number and account email to wpsender.globalcrm.in when a batch starts.

Goodkey sends text from active webpages to mcc.r-broker.ru while its page indexing feature is active.

Google Analytics UTILS sends the active tab domain and a _ga cookie-derived client ID to Amplitude.

Google Chrome Profile Lock stores its profile-lock password and recovery key reversibly in Chrome synced storage.

Google Takeout Mileage & Timeline Exporter sends Takeout place IDs to Google Places API when you translate locations.

GreenGuard redirects visits to some merchant sites through affiliate tracking links.

Groupboss stores backend auth tokens and optional saved login passwords with a hardcoded encryption passphrase.

Tube Transcripts reads YouTube cookies and sends them to its Cloud Functions when used in YouTube Studio.

HCOS auto deletes browser history URLs with broad search-query markers after Google search activity.

Happy Cat sends your Chrome profile email and stable profile ID to api.tuhocvangioi.com when its new tab opens.

HappyDoc Chrome Extension forwards eVetPractice tokens and appointment data to HappyDoc API endpoints.

Heart Exchanger for Etsy can send raw Etsy page HTML back to its WebSocket service during remote tasks.

Huboh AI fetches server-assigned URLs with browser credentials and sends extracted page content to gateway.huboh.cloud.

HumanLetter sends Gmail message content and metadata when it detects hidden tracking images.

IExtension accepts login bearer tokens on plaintext HTTP SSO redirect URLs.

Infigrowth SEO Extension sends the active tab URL to Google SEO and Chrome UX Report endpoints when its popup runs.

Instant Multilingual PDF/HTML/TXT Dictionary can send selected password-field text to its translation provider.

Jotit stores user-entered two-factor authentication secrets in Chrome sync storage without encryption.

KJV Simple Search Parallel Bible App sends selected or omnibox Bible search text to dailywordofgodgroup.com over HTTP.

Kwanko toolbox sends failed-login API keys to Google Analytics as an event label.

Land Insights Toolkit sends LandPortal account, billing, subscription, and cancellation data to api-landportal.vercel.app.

Landing Page Ripper sends your Chrome profile email and captured page URLs to track.landingpageripper.com.

Leads Connect sends Instagram account IDs to app.socialeai.com when country or gender filters are used.

Les bons Plans remises & Cashback FLOA sends recognized merchant visits to Google Analytics with a persistent extension client ID.

Link Unshortener sends matching shortened-link navigation URLs to linkunshorten.com through redirect rules.

LockTheLoad opens account pages with your bearer token in the URL and sends viewed DAT/TruckersEdge load details to its API.

Locker protects cloud-synced private bookmarks with an encryption secret bundled in the extension.

London Background Pictures New Tab sends searches typed on its new-tab page to feed.yeshlasearch.com.