Medium risk browser extensions

obsidian-livesync-webclip sends clipped page content and saved CouchDB Basic credentials to a configured database URL.

Đánh giá nhanh - DTU captures the visible MyDTU tab and sends the screenshot to Google Gemini for CAPTCHA solving.

VPN for Claude supplies proxy credentials to sites that request HTTP authentication.

SkyBridge supplies its proxy credentials to website authentication challenges while the VPN is connected.

云神价-购物点点 reads Weibo account IDs from open tabs and sends them to www.yunshenjia.com.

友鹰数据(Extension) fetches server-selected JavaScript and runs it on marketplace pages.

智小抖 - 抖音AI全能助手 captures Douyin, Douhot, and Compass API responses and sends them to api.petslib.cn.

比特币行情 上班盯盘助手 sends bundled API keys to CoinGecko Pro and Mifengcha when fetching market and news data.

絶対に忘れないAI辞書 - ディクト sends DiQt API requests with an embedded Basic authorization credential.

锐达RCL-TK店铺运营AI助手 sends TikTok and Tokopedia seller cookies to twelve extension IDs every 30 seconds.

Simple Price Alerts loads affiliate tracking URLs on shopping pages and fetches remote boun.me rules that control page hooks.

AdBlock Ninja reads your precise device location and sends it to its own servers during account signup and social login.

English Popup Dictionary sends selected words, page URLs, IP addresses, and user agents to advertising services during lookups.

UTurbo sends the active tab URL and browser user agent to carbonvpn.tech when its popup opens.

Android emulator MyAndroid reports every website you visit to its own server, once per day, keyed to a persistent per-install ID.

AI Platform captures your app.scade.pro login session cookie and sends it to a third-party tracking server.

Nike MeaVana sends the IP Info utility's public IP lookup to ip-api.com over cleartext HTTP.

Yandex search by image sends the URL, title, and referrer of every page you visit to Google Analytics with a persistent per-install ID.

OfficeWork sends the URL of nearly every page you visit to a third-party server and can be told to redirect your tab.

Adblock YouTube opens hidden affiliate tabs on ~11,000 partner sites, disguised to users as a tree-planting 'Eco Mode'.

Friend Requests Sender collects Facebook users' email, phone, address, and birthday from imported profiles, undisclosed in its listing.

LinkedIn Video Downloader sends the user's signed-in Google account email to an unrelated third-party licensing server.

SaleFlow reads Wildberries' own anti-bot session tokens from the page and sends them to its own backend on every API call.

FastProxy logs every site you visit and periodically sends the encoded browsing history to its own servers.

Translate Webpage stores original page text and URLs in each site's localStorage after translating HTTPS pages.

AutoSkipYT for YouTube posts Google or Bing search-page URLs to a remotely configured endpoint.

Malus VPN sends the full URL and page title of every proxied tab to Google Analytics and its own backend.

Idle Forest bundles the Mellowtel SDK, which loads pages in a hidden tab and sends their content to Mellowtel's servers.

Adblocker X fetches addonsrv.net rules that can inject controller iframes into matching websites and alter page content.

iGive Button initializes PostHog analytics with autocapture on every page you visit, not just cashback merchant sites.

PriceBlink runs vendor-served, per-retailer config strings as page-context JavaScript during its auto-coupon flow.

Talia reads your LinkedIn session cookies and sends them to its vendor backend, and collects candidate data from recruiting and email pages.

Vocabulary builder injects a remote vocabulary.live sidebar into any site, giving it read/write access to the page and its local storage.

Labs Token PRO captures Google OAuth Bearer tokens from every website visited, not just labs.google, storing the last 5 unencrypted locally.

SavvyConnect streams every page you visit, plus raw request/response headers including cookies, to Luth Research.

Workstation for Discord has no local Discord client; every button loads a third-party site, winfy.net, to handle the Discord session.

Shotcut online video editor sends every visited URL and download to runapps.org and can redirect the tab based on the server's reply.

HTML editor WebStudio for Webpages sends the URL of every site you visit to a tracking server on each tab switch.

Portal Link Generator sends your Bybit and MEXC identity-verification session tokens to a third-party server.

BDRIS Reporting Tool scrapes citizens' National ID and MyGov profile data and sends it to the vendor's own server unconditionally.

Adobe Bulk Download sends Chrome account identifiers to a license server during startup license checks.

APP For IG DM sends your Instagram CSRF token and inbox data to an Alibaba Cloud analytics backend during auto-reply.

Music Downloader | VK Music Saver silently sets devicereset.online as the browser's default search engine on install.

ChatGPT Assistant - GPT Search sends everything you type into Google, Bing and other search engines to a third-party server, not to ChatGPT.

Messenger Central sends new-tab search queries to srchms.com with a fixed affiliate identifier.

Video converter online VideoConvertPlus reports every .html/.xml page you visit to its vendor's server and can open a new tab in response.

Reffer App fetches a server-assigned target URL and CSS-selector schema, then crawls and scrapes up to 500 pages on any site.

Email Search and Outreach by Sprouts captures your live LinkedIn session cookies and sends them to its own backend.

UAR_SKI_V2P monitors every page you visit and sends the URL to a native application when it detects a marker element.

Автоотклики на HH — HeadHunter sends saved Telegram usernames to a TributeManager access-check API.

Hagro reads your full LinkedIn cookie jar, including the session-auth cookie, and exposes it to its own site.

Pague Menos Be!Tech loads a remote config on every site that can send page content, page variables, and cookies to its own server.

FDev Security sends the hostname of every site you visit to its developer's own server, with no way to turn it off.

KittyCursor bundles GiveFreely affiliate code that runs on every page and reports the URLs you visit to events.givefreely.com.

Vinted Checker sends the full URL and page content of every product page you visit to its own servers, contradicting its privacy policy.

Calculator Extension redirects visits to server-listed sites and rewrites clicked links through a remote-chosen URL.

Kendo-Linkedin Email Finder auto-pages LinkedIn search results and uploads every listed member's profile data to its own server.