Medium risk browser extensions

Speed Whats Sender sends WhatsApp login passwords in API URLs and stores credentials in web.whatsapp.com localStorage.

Spoke initializes PostHog on Meet and Spoke pages and can upload page telemetry and session snapshots to CloudFront.

Sport background pictures new tab sends new-tab search queries to rotating third-party feed domains.

Spotify to Apple Music Playlist Converter stores an Apple Music user token in Spotify localStorage for about six months.

StreamFab Video Downloader sends cookies from the active non-YouTube site to its native companion app.

TOTP Authenticator stores and exports saved authenticator secrets in plaintext.

TS3MusicBot WebStream sends tab audio, page details, and saved webinterface passwords to user-configured bot hosts.

Taobao Helper sends popup search terms to ai.taobao.com over cleartext HTTP.

TaskPulse Task Verifier injects hooks on server-named domains to capture network traffic and page content on those sites.

Temora sets itself as the default search provider and sends search and usage telemetry to fwsrc4you and Temora endpoints.

Automatically applies coupon codes at checkout for participating online stores.

Text to MP3 sends selected page text to its synthesis API and can include user API keys in Sentry tracing.

TikTok Ads Balance & Top Up TikTok Ads stores remembered login passwords in extension localStorage.

TikViral stores the extension account profile in TikTok-origin IndexedDB.

Tipli reads selected page text and sends it with the page URL to www.tipli.hr when its remote feed matches a site.

Tipli: Cashback nagrade in kuponi uses remote feed rules to scrape matching pages and sends selected text to Tipli.

Tippin Extension (tippin.me) sends Twitter usernames and tweet IDs with a hardcoded API credential to api.tippin.me.

Toggle X records clicks, non-password form input, page URLs, and full page text from websites and sends them to x.toggle.pro.

The extension sends selected English words to Youdao over HTTP when pronunciation audio plays.

TuffBlocker sends supported shopping and Google page URLs with an install identifier to api.weberowsky-yt.workers.dev.

Twitch Auto Bonus sends channel bonus-claim events with a persistent install ID to apiget.ru.

Twitter Enhanced sends saved Twitter/X remarks and usernames to Google Analytics when remarks are used or updated.

Typster stores your OpenAI API key in Google Docs page storage and sends it to OpenAI for AI typing features.

UFC Calendar embeds an API credential and sends it to its AWS event API.

Ultimate Office Tools sends new-tab search queries to f.frequentvisitor.com with a hardcoded affiliate token.

Unicode Analyzer sends selected page text as codepoints to an i18n-cloud.appspot.com HTTP endpoint.

Unify stores OAuth access and refresh tokens using an encryption password bundled with the extension.

Uninquizitive modifies Norton InQuizitive pages to change scoring state and suppress anti-automation checks.

UserAdvocate sends embedded UXArmy API credentials in headers on test API requests to app.uxarmy.com.

UserVoice Feedback Capture captures full page text and email addresses from every site into extension messages.

Velocity sends signed-in users' ChatGPT, Claude, and Gemini chat transcripts to ThinkVelocity ContextEngine.

Vimeo Video Downloader sends embedding-site cookies to Vimeo when fetching embedded video config data.

Vindy sends Vinted draft-debug reports with listing and user details to a hardcoded Discord webhook.

VirusScanner reports every URL you visit and every file you download to third-party servers, tagged with a persistent tracking ID.

Visibrow sends active and completed tab URLs to its categorization endpoint.

Visualizzatore file fprg sends invalid Flowgorithm file contents to Google Analytics when parsing fails.

Vysor Web Capture stores the user's raw Vysor password in extension-local storage for automatic reauthentication.

WASendBulk sends WhatsApp profile details, page telemetry, and outgoing links to Google Analytics and backend services.

WPoptic sends your Chrome profile email to api.wpoptic.com and reports WordPress site URLs and detected technologies.

Wachete sends the active tab URL to www.wachete.com over cleartext HTTP when clicked.

Walmart Only No Third Party Seller sends Walmart list URLs through a Walmart affiliate redirect when clicked.

Wasubot lets WhatsApp page scripts read selected extension storage through its message bridge.

Wazo extension sends debug logs with account and server metadata to a remotely configured logging host.

WebP to JPG sends selected image files and image URLs to a conversion server over cleartext HTTP.

Whale - Product Importer sends AliExpress product-page URLs to dsreviews.net and injects the returned affiliate iframe.

WhatSender PRO sends URLs from outgoing WhatsApp messages to third-party link-preview servers.

Whiteboard inserts Heroku-hosted story media and link fields into UTD Blackboard pages without sanitizing them.

WordPress Theme Detector sends the active site's hostname and IP address to ip-api.com over HTTP.

WriteMe.ai reads REACT_TOKEN_AUTH tokens from pages and sends them to apiv2.writeme.ai.

Yog B2B sends support-ticket details to Airtable and login auth keys to Procbee while embedding API credentials.

Youtube Timestamp Saver stores saved video thumbnail URLs that the options page requests from YouTube over HTTP.

Zid Sway3 replays Rosetta Stone API requests with modified progress and lesson-completion values.

beta工具 fetches remote Alibaba tool config, calls configured URLs, and sends encoded responses back to beta.alibaba-inc.com.

dict.cc context menu sends selected page text to dict.cc over an unencrypted HTTP search URL.

html.tomake.design (llama) lets any website trigger a page DOM capture into a downloaded .h2fig file.

iTracker: IG Unfollower Checker uses vendor rules to make Instagram API requests with your session data.

midjourney to notion sends saved prompt details and subscriber identifiers to gpts-api.gpt-stores.com.

The extension sends Wildberries seller supplier phone numbers and IDs to mphero.io weekly.

The extension sends Wildberries supplier phone contacts and old IDs to plugin.mpstars1.ru.