Medium risk browser extensions

This extension clears browsing data such as history, cache, cookies, downloads, passwords, and saved form data.

Color Picker - Eyedropper Tool puts user-triggered tab screenshots in a page-readable canvas.

Docs Online Viewer fetches headers for document links on web pages through its background service worker.

Adds fitness trends, progress tracking, and enhanced activity statistics to the Strava web app.

FoE - Helper sends Forge of Empires player and guild identifiers to api.foe-rechner.de when the game starts.

Free Time Games executes scripts from its remote changelog inside the extension options page.

GamersClub Booster embeds a shared Basic API credential for GamersClub player and match-history API requests.

This extension summarizes and translates YouTube videos, searches, PDFs, emails, and webpages with AI assistance.

Google Translate Plus AI sends auto-translation source snippets and file metadata to api.gtranslateplus.com.

Imagus downloads an update-able rule file from tiny.cc and runs rules written as JavaScript on any page you hover an image on.

KISS Translator reads visible text from pages you translate and forwards it to a third-party service, by default Microsoft Translator.

Kimi WebBridge lets a local WebSocket service issue browser automation commands through Chrome debugger access.

Language Learning with Netflix & YouTube sends subtitle text, viewing metadata, and your email to its appforlanguage.com servers.

Download online videos for offline viewing from supported websites.

This extension helps you keep track of upcoming TV shows and movies.

RightInbox connects Gmail pages to RightInbox and Mailshake services for reminders, tracking, templates, and notes.

Roblox Friend Remover Button modifies Roblox purchase pages to promote RoEarn and roexport redirects.

Spoof Geolocation exposes stored spoof-location settings to scripts running on every HTTP or HTTPS page.

Subtitles for Language Learning stores OpenSubtitles credentials using a passphrase bundled with the extension.

This extension receives browser notifications from a paired Synology DiskStation NAS.

Tabs Outliner sends a SHA-1 hash of the Chrome profile email to FastSpring during purchase checkout.

Vue.js devtools forwards captured timeline screenshots into the inspected page through a window.postMessage bridge.

WaSeller stores your WhatsApp and Google login tokens in the page's IndexedDB, "encrypted" with a key hardcoded in its own code.

Web Paint Tool stores page drawings in each website's localStorage where that site's scripts can read them.

YouTube Tags sends YouTube watch-page video IDs to Google Analytics with a persistent extension UUID.

Manages multichain crypto activity across EVM networks, TON, NEAR, Solana, Stellar, and TRON.

I.CA PKI Service Component accepts cookie-read requests from third-party web pages and forwards retrieved banking-domain cookies to a native host application.

This extension tests available Shein discount codes at checkout and applies the best one to your cart.

SingleFile bundles hardcoded OAuth client secrets for Google Drive and Dropbox, and a hardcoded Woleet API bearer token, in its source.

User-Agent Switcher and Manager fetches its agent list from cdn.jsdelivr.net at an unpinned @latest reference with no integrity check.

Mendeley Web Importer sends analytics with your IP address and device fingerprint to New Relic, Adobe Analytics, and Mendeley.

EXIF Viewer Classic lets webpages trigger cross-origin image EXIF reads and displays the parsed metadata in the page.

Mochi Dictionary Extension ships a static Mochidemy API key used for dictionary and profile API requests.

Pomodoro overrides the browser's default search engine to pomodorosearch.com, routing all omnibox queries through a third-party domain with a per-install tracking ID.