Medium risk browser extensions

Lystos en tu portal - ES sends the full Registradores page HTML to services.lystos.com when registry results change.

MYBEST代购代运助手 sends parcel form details to MYBEST over cleartext HTTP.

Macro Settings by FOODFASTFIT lets an HTTP site set macro goals that it later posts to MyFitnessPal.

Magic Extension sends active-tab URLs, page titles, and input-activity counts to the Magic web app.

Mais e-Sports Descontos sends matched shopping-page URLs and extracted page values to descontos.maisesports.com.br.

MathGPT uploads user-selected screenshot regions and sends the resulting image URL to its solving service.

Mazepool exposes typed license keys to Facebook Ads Library page scripts and sends them to Gumroad for validation.

Mega Messenger periodically reads Facebook friends' birthdays and sends the birthday list to next.cloudki.io.

Mochimo Wallet sends wallet API requests to a built-in Australia mesh provider over cleartext HTTP.

MyQ X Chromebook Client sends OAuth client registration and token traffic to the configured print server, including over HTTP.

Name Generator retrieves generated password material from randomprofile.com over cleartext HTTP.

Nature background pictures new tab sends new-tab search terms to direct.searchontop.com with publisher identifiers.

Neatly derives the account password it sends to its API from the signed-in Chrome profile email and ID.

Nectar for Whats stores the Nectar CRM access token in WhatsApp Web localStorage with reversible encoding.

NetflixProxy sends login credentials and account tokens in URL query strings to nf.startapi.win.

NewTab新标签页 fetches JavaScript-like instructions from api.newtab.com and runs them on its new tab page.

Neymar Jr MeaVana embeds a Google Translate API key in its shipped translation utility.

Numintec for Chrome stores account passwords in chrome.storage.local and sends login credentials to InvoxContact.

Offsite - Save to monday.com ships hardcoded API and OAuth secrets used in AddOffsite and monday.com requests.

Open Bookmarks in New Tab rewrites some Google, Microsoft, and Baidu bookmarks through a GitHub Pages redirect.

OpenBnB identifies your Chrome profile email to PostHog when the extension is installed.

OutX imports Supabase code from esm.sh into its background service worker at runtime.

PDF Clipper sends new-tab search queries and affiliate parameters to find.vplay-fuel.com.

PDF Converter sends searches typed on its new-tab page to find.digital-marketing-ads.com.

PaperSpan opens its list page with the stored access token in the URL query string.

Paragraph Rewriter sends selected or typed text and prompts to api1.lightdragon.club for rewriting.

Paris Background Pictures New Tab sends typed new-tab searches to random feed domains.

Phantom: Lofi Tutor sends selected saved chat text to an AWS Polly demo page for voice playback.

Pomodoro Timer for Google Calendar sends Google Calendar event titles to Google Analytics when a user starts a timer.

Poplingo removes frame-protection headers from subframe responses while its link preview is open.

PremierLeague Stats sends new-tab search terms to prls.premierleaguestats-ext.com with a tracking ID.

Privacy Guardrail can send stored original text back to supported AI chat pages through its clipboard restore flow.

Proboost Vocpro embeds a DashScope API key and sends DeepSeek chat requests to Alibaba's DashScope API.

Prodigy Hacking Extension | X Loader fetches and runs remote Prodigy hack code on Prodigy game pages.

Prompt Viewer renders extracted image metadata into the page DOM after you use its context menu.

RSA Test Finder sends saved email addresses and driving-test slot alerts to SMTP2GO.

Recipe Reader & Grocery Finder sends encoded Amazon Fresh recipe ingredients to cerescart.com over HTTP.

Redmine Notification sends the user's Redmine API key to configured HTTP Redmine servers in URL query strings.

Reffer Lite App accepts remote crawl tasks and returns parsed page content to app-lite.reffer.ai.

Roketfy Etsy SEO sends Roketfy login credentials in a URL query string and includes a shared bearer token.

RollViewer - GordaoDAORA reads your Steam ID on CSGO-Skins pages and sends it to RollViewer's API for subscription checks.

Safari New tab sends logged-in Google profile details to Mixpanel and syncs saved tab history to sfnewtab.ashusharmadev.com.

Scaler++ syncs Scaler profile, contact, and performance details to scalerbackend.vercel.app.

Scope Health lets its sidebar capture EHR page HTML, form fields, and matched API traffic on supported EHR sites.

Scouter sends language-learning prompts to OpenRouter by default and uses Azure Speech for text-to-speech.

Search Tool (AI) sends matched history and bookmark domains to icon.horse when showing popup suggestions.

Searcher for Discogs sends selected artist, style, and track metadata to Google Analytics.

Send 2 Photopea sends selected page image data and URLs to Photopea using generated Photopea script commands.

Shop Deals sends Google search result URLs to Takeads and rewrites eligible results to affiliate links.

Shop Mail reads cart item details from shopping pages and sends them with the page URL to its coupon API.

Shopflo Operator lets Shopflo's remote config set Shopify app OAuth scopes and reports merchant workflow activity.

SiaBot - Siaep MA sends SIAEP school, user, class, and worksheet row counts to a Google Apps Script endpoint.

Siap Dips sends Moodle quiz content to AI endpoints and can rewrite a Safe Exam Browser attestation header.

Slack Printer sends Slack page URLs, titles, and browser interest cohort data to slackext.com analytics.

Smart Video Downloader fetches remote network rules that can modify browsing requests across all sites.

Smm-helper fetches remote GitHub news settings that can inject JavaScript into VK pages.

Social Toolkit stores the user's login password in extension localStorage before login succeeds.

Sparkly exposes tab, history, and Workspace search metadata to pages while its search overlay is open.