Medium risk browser extensions

Adds searchable or user-provided subtitles to videos on streaming websites.

Voice Control for ChatGPT sends ChatGPT conversation URLs and page titles to Google Analytics with a persistent user identifier.

SaveFrom.net helper opens a WebSocket connection to sf-helper.com and can fetch arbitrary URLs on command using full browser permissions.

Shows the technologies used on the website you look up with a click.

D.Bridge 2 relays postMessage calls from any webpage to a local native messaging host with no origin allowlist.

Replaces the New Tab page with a customizable dashboard for shortcuts, bookmarks, widgets, and appearance settings.

Nuance PowerMic Web Extension injects a tracking cookie and device-control API into every HTTP/HTTPS page the user visits.

Popup Blocker (strict)'s notification page accepts messages from any site, letting it be tricked into redirecting your tab to an attacker's URL.

The extension fetches remote JavaScript from widgets.trustedshops.com and injects it into e-commerce pages without integrity verification.

This extension provides a VPN service for watching YouTube with faster video loading.

Advanced Ad Blocker fetches remote update data that can inject page elements and replace browser network-blocking rules.

Assinador Digital Qcertifica relays postMessage requests from any web page to a native signing host without validating the message origin.

Cold Turkey Blocker's block-page frame accepts unblock commands from any origin, allowing a blocked site to remove its own block.

Blocks popups and intrusive ads to reduce distractions while browsing.

Custom Calendar Background lets any site set its theme token and adds your Google account email to calendar.useit.today image requests.

Diigo Web Collector lets any matched webpage request Diigo bookmark/account context through unchecked messages.

Free Time Games executes scripts from its remote changelog inside the extension options page.

The extension exposes an unauthenticated WebSocket proxy to every webpage via a content script injected into all URLs.

LikeBoost polls LikeBoost servers and uses your Instagram or Facebook session to like server-selected posts.

Open incognito tab sends feedback messages and the active tab URL to Telegram.

Koala Inspector sends page DOM and form input to OpenReplay while its in-page UI is open.

Speed Dial sends saved bookmark URLs to speed-dial.net over cleartext HTTP when bookmarks are added or edited.

Send bulk WhatsApp messages to multiple contacts without saving each number first.

ePadLink SigCaptureWeb SDK Extension relays arbitrary page-controlled data to a local native signature-pad application on every website.