Medium risk browser extensions

DealsUpp wa message sender sends WhatsApp page details to Google Analytics and link URLs to preview services.

Discord Batch Deleter sends Discord channel URLs to slackext.com when a user starts batch message deletion.

Dispatcher Paragon Chrome Print sends access tokens and print-job documents over HTTP when HTTP mode is enabled.

EMB Tools sends your nickname and public IP to its proxy API over plaintext HTTP.

ERP Auto Login - IITKGP stores saved ERP passwords and security answers in plaintext when users save them without a PIN.

Ecto Wallet logs wallet seed phrases, private keys, and passwords to the extension console during wallet setup and import.

Email Generator renders remote email HTML from emailgenerator.24maxkazakov.ru inside an unsandboxed popup iframe.

Email finder reads LinkedIn data via your logged-in session and collects emails from pages you visit, then uploads them to soujiyi servers.

EpubPressX sends the selected tab title to api-title-short.link2epub.com over plaintext HTTP.

Expressfy sends its stored account token to app.expressfy.com over cleartext HTTP during product override.

firestore export in one-click sends sample Firestore export data and Firebase context to Mixpanel during exports.

Full Screen Tabs exposes history, bookmark, and open-tab suggestions to page scripts while its nav bar is active.

Get Transit Schedules makes gettransitschedules.com the default search provider and sends address-bar searches to it.

Grandstream GRP Click2Dial injects stored contact details into pages after matching selected text.

IG Followers Manager sends a built-in bearer token to the vendor API for process and account actions.

LibreOffice writer online sends matching navigation and download URLs to RunApps before opening its viewer.

Live Wallpaper: Luffy Straw Hat - One Piece adds campaign parameters to Google and Bing searches from its new-tab page.

MasterCook stores remembered account passwords in local storage using reversible AES with a hardcoded key.

Memos sends bearer tokens and memo data to a user-configured Memos API URL, including over HTTP if that URL is used.

Mercado Livre TrueSort fetches affiliate-link rules from bembarato.org and rewrites matching links on pages you visit.

This extension redirects partner shopping and travel sites to activate miles and points promotions.

Mooon ships Azure Speech subscription keys and logs active page URLs and titles to Supabase.

Motorcycles Wallpaper sends searches typed on its new tab page to lsrcunow.com.

NoteTab - Save Your Thoughts sends new tab search queries and saved bookmark domains to external services.

Omni Convert redirects default omnibox search queries to find.madmidas.net monetized results.

Pocket Prompt sends prompt context and account email to its API when users run a prompt.

Porto sends tweet archive link URLs to third-party preview and proxy services while building Bluesky embeds.

Privacy Protector removes CSP and X-Frame-Options headers from every HTTP and HTTPS frame.

Prompt Engine Pro stores its API token as a page-readable cookie on ChatGPT pages.

PureTwitter sends X account block-list telemetry to puretwitter.ikeyly.cn over cleartext HTTP.

Quick Text Extraction writes OCR text from selected screenshots into the page DOM.

R Discovery: Academic Research sends article metadata to R Discovery and posts CleverTap analytics with a bundled upload passcode.

RSS Subscription Extension, Reader sends selected RSS feed URLs and reader options to rssmerge.flowsoft7.com over HTTP.

Recapio: AI Youtube Summarizer automatically sends YouTube watch URLs to Recapio's API for transcript/chat processing.

Safeguard Enterprise Password Vault opens its vault web UI with the bearer token embedded in the tab URL path.

Saturation Scout sends product-page URLs, matching store domains, and product image data to external services.

ScreenTime sends tracked website hostnames to Google's favicon service when its popup displays usage history.

Search by image on Alibaba sends visited URLs to apiheaven.io and can redirect a background tab from server-provided links.

SeoLift uses a plaintext seolift.pro control channel to inject ad overlays and open or redirect tabs after user activity.

The extension builds share links that send the active tab URL and title to multiple sharing services, some over HTTP.

Sharkdropship ships a recoverable API key used for license validation.

Smart Color Picker and Palettes places visible-tab screenshots into pages during picker mode.

SnapThePrice opens a hidden affiliate redirect that includes the active tab URL.

Spotless: Spotify Ad Muter injects hidden browsebetter.io iframes into Spotify pages on first run and after use.

StarNgage Instagram Profile Analyzer sends login emails and passwords to api.plus.starngage.com in a URL query string.

Stellar Mod For Slither.io sends saved team and tag passwords to scripts on slither.io and slither.com pages.

Swiggy Zomato Blinkit Spends sends active-tab Blinkit token values to Blinkit order-history endpoints.

Synclify sends video-detection failures with the full page URL and a persistent analytics ID to its API.

Trust.Zone VPN Proxy sends account passwords to robocloud.top in a login URL query string.

TubeX.Chat places the saved LLM API key into a password field in the YouTube page DOM while settings are open.

Tubi Speeder sends Tubi profile identifiers, continue-watching history, and playback events to me3x.online.

Turbo Stream routes most browser traffic through 72.56.50.29:43799 when its Server 4 proxy option is enabled.

URIRANK - Alexa Traffic Rank sends each top-level navigation URL to urirank.com.

UchiX sends Uchi.ru access tokens and school account details to api.cdz.rip while solving tasks.

Video Downloader rewrites response headers for MP4 files and requests from noname.technology.

Virat Kohli MeaVana removes anti-framing headers when it loads third-party integrations in extension iframes.

WA Quick Group sends generated WhatsApp group invite links to third-party link-preview services during invite messages.

Website Unblocker routes selected sites through embedded proxy servers using hardcoded shared credentials.

XPLA GAMES Wallet broadcasts wallet address changes to every open web page where its provider is injected.