Medium risk browser extensions

Yoko Networks Click to Call supplies saved phone credentials to HTTP auth challenges from any website.

Zabbix Vue can send Zabbix passwords or API tokens to user-configured HTTP API endpoints.

eBextractor sends eBay purchase-history page HTML and page cookies to wcawasa.pythonanywhere.com when local parsing fails.

ideaocam makes camera media uploaded to Google Drive readable to anyone with the link.

multiAccounts modifies subframe headers to remove CSP and X-Frame-Options after site access is granted.

nDocuSoft sends NREGA workflow URLs with stored Digest values over cleartext HTTP.

Яндекс Вордстат Extension sends XMLProxy API keys and keyword queries to xmlproxy.ru over plaintext HTTP.

BlackJack 3D sends popup game identifiers to mines.cloudapi.stream and uses the response to control game behavior.

Debrid-Link Plugin exposes link metadata in page DOM and lets HTTP(S) pages trigger notification actions.

V3 - Get Old YouTube Layout fetches JavaScript from vorapis.pages.dev and injects it into YouTube pages.

Qui-Quo fetches server-selected content scripts and hot-patch code that can run on any site.

Imagus mod runs auto-updated remote sieve rules as code on every site.

[Unofficial] Saladict - Pop-up Dictionary sends selected text to Baidu translation and speech endpoints over HTTP.

Magnifying Glass (Hover Zoom) places a captured screenshot of the visible tab into the current page DOM.

InteractiveFics writes saved replacement values into matching pages where site scripts can read them.

ABV Notifier stores ABV account passwords in browser storage in a form recoverable with nearby stored data.

Email Extractor collects email addresses from visited pages and sends batches to mailshunt.com.

Font Changer rewrites shopping links and queries deals99.com for affiliate promotion URLs.

Search Engines Helper sends user-created search engine definitions to http-request-echo-server.onrender.com.

oneClipper oneNote web clipper sends page or selected content to Google Gemini for AI clipping features.

Quest PDF sets itself as the default search provider and sends search and suggestion terms to QuestPDF and Yahoo endpoints.

YouTube Adblocker injects a hidden remote iframe from modal.style on every website after an eight-hour delay.

Gaming News Feed sends new-tab search terms to bethegamepro suggestions and submitted searches to Yahoo.

360 Ribbon fetches remote EHR rules that execute JavaScript while reading patient names and dates of birth.

ASUS Download Master Chrome Extension sends router login credentials to its default HTTP router endpoint.

AceConnect IN stores encrypted auth tokens using a hardcoded password bundled in the extension.

Ad Dimmer fetches remote rules from addimmer.com that can inject page-context scripts on visited sites.

Agency Dashboard SEO Extension sends the current site's domain to APILayer and WhatCMS from its popup tools.

Agent Quick Tools rewrites shopping-agent product and registration URLs with its own affiliate codes.

Aionda Mail sends classic login credentials and session IDs to mail.aionda.com in URL query strings.

Ali Hunter sends AliExpress product URLs to a Glitch service and rewrites AliExpress pages through affiliate links.

Ali Hunter rewrites AliExpress product and cart visits through affiliate links.

AliExpress & Alibaba Dark Mode forwards clicked shopping URLs to alitems.link affiliate redirects.

AliSave redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliVoice redirects matching AliExpress pages through affiliate deep links and sends the page URL to alisavetools.com.

Alibaba, AliExpress & 1688 Search by Image redirects matching product pages through rzekl.com affiliate links.

Aliexpress image downloader redirects AliExpress item, cart, and order pages through s.click.aliexpress.com.

Amazon Prime Subtitles & Dictionary adds your email and last watched Amazon URL to its uninstall URL.

App Studio sends popup search and download activity with a persistent install ID to an n8n webhook.

Apple Music(iTunes) Web Player sets Chrome searches to chromecrxstore.com and sends omnibox search terms there.

Atomic Fusion stores its login token in Bubble page cookies that host-page scripts can read.

Authenticator stores TOTP enrollment secrets using a hardcoded fallback key when access-key encryption is off.

Auto Answer Edunext sends captured EduNext authorization headers to chat.ptudev.net during user-ID lookup.

Auto BCC for Gmail sends saved Auto BCC rules and cached Gmail sender choices with support requests.

The extension sends Slack message text to translate-api.ext-api.com over plaintext HTTP for DeepL/GPT translation.

Bing Maps Leads Scraper places Google OAuth access and refresh tokens in its Mapleadscraper pricing page URL.

Bookface Companion sends Gmail thread participant email addresses to Bookface when Gmail conversations load.

Bookmark Preview sends bookmarked page URLs to Google favicon service when rendering bookmark previews.

BudgetBuddy sends new-tab search terms to suggestion and search redirect domains.

Calculator Extension sends searches typed on its new-tab page to brownmile.com.

CheckFlow Browser Relay can attach its local debugger relay to sites saved in its own blocklist.

Ciphix Mendix dev tools saves Mendix passwords and bearer tokens in page localStorage as plaintext.

Claude2PDF sends the active Claude page HTML to www.aihuoji.com when exporting a conversation to PDF.

Clifl reads YouTube page data and account identifiers during server-directed viewing tasks.

Coursera Summary with ChatGPT and Take Notes signs NoteGPT API requests from bundled extension credentials.

CovidDash at Johns Hopkins University replaces browser search, homepage, and startup settings with coviddashboard.extjourney.com.

Cricket Score Bar inserts Cloudinary-hosted score images into every tab after a match is selected.

Ctrl+Tab MRU inserts current-window tab titles and tab IDs into the active webpage DOM.