Medium risk browser extensions

Product Search sends visited page URLs to apiheaven.io and can redirect tabs through apiheaven.io/pulse.

QR Code Scanner and Generator writes scanned QR text and a camera still into page-readable DOM on every site.

ReadLite posts selected text and highlight notes from reader mode to the host page.

Roblox Characters Custom Cursor loads selected cursor images from allcursor.com on pages you visit.

Robô de Comentários - Bot de Sorteios sends Instagram profile details, location, and device data to botsorteios.com.

SNDL opens its login page with saved credentials and the active tab URL in the address bar.

Safe Search Engine sends new-tab search terms to server.taskticks.com before opening Google SafeSearch.

Salvage Auction Research Tool sends auction page HTML and protected auction records to AuctionHunter.

SamuMoa stores the OBS PeerJS connection key in marshmallow-qa.com's page storage.

Records browser tab audio, microphone audio, and screen activity from the browser.

Search by image on Ebay sends visited page URLs to apiheaven.io and may redirect browser tabs from remote config.

Self Messenger sends your WhatsApp number to Google Apps Script and an HTTP quota endpoint.

Shopflo Operator lets Shopflo's remote config set Shopify app OAuth scopes and reports merchant workflow activity.

Smart Fiverr sends Fiverr account details, including email and name, to Mixpanel during login and account changes.

SnapGen Flow imports remote GitHub selector settings that guide its Google Labs Flow page automation.

Somiibo redirects shopping and rewards sites through hardcoded affiliate/referral links.

Speed Dial Dogs sends new-tab search text to addonsearch.net and Bing.

Stream Live sends VKVideo localStorage auth data to its backend during the sign-in flow.

Supercharge for Bolt.new embeds API keys and sends scrape and search requests to Firecrawl and 21st.dev.

TEMU Hide Local Products fetches rules from iltekin.com that can alter Temu pages and add affiliate parameters to Temu URLs.

TYNA reuses saved manual proxy credentials for every browser authentication challenge while the proxy is active.

TabMetrics sends new-tab telemetry and search input to tracking and search services from its replacement new-tab page.

Tarss reads every linkedin.com cookie, including the HttpOnly li_at session token, and sends it as the Authorization header to api.tarss.fr.

TheChannel Viewer for Gmail posts embedded-page URLs, titles, and engagement activity to parent frames.

Time Limit loads third-party JavaScript from cdn.muicss.com inside its extension popup.

Tokmate sends TikTok profile, search, video, account, and Ads API data to api.tokmate.com.

Travel Mapper sends saved activity names and source URLs to Amplitude analytics.

Udemy Downloader sends signed download and account-status requests to udemy-downloader-ext.vuvuive.org.

VPN Facebook fetches remote proxy rules that can replace its PAC script and route browser traffic through configured proxies.

VPN for Chrome by WizVPN sends encrypted browsing and referrer telemetry to wizvpn.net during page loads.

Velio collects Twitter/X, Reddit, and LinkedIn feed content and uploads it to api.requests.velio.co.

The extension lets webpages trigger a preview that strips frame-blocking headers and frames page-chosen URLs.

Video to MP3 uploads user-selected converted audio for AI transcription.

WA Blaster embeds a reusable bearer token for its CRM lead-update API in the installed extension package.

YouTube Watch Later Bulk Delete posts feature activity and a persistent user ID to youtubeshorts.ru.

ZKX Web3 Wallet sends a persistent instance ID and selected account address/balance to Ambire price requests.

Zima Nodes sends login credentials over HTTP when a ZimaOS address is saved without an HTTPS scheme.

aiApply copies job application inputs and generated AI output into Alibaba Cloud log events.

fubukicss-tool redirects and rewrites Figma application scripts using rules fetched from ecomfe.github.io.

repmafia.net tools rewrites referral cookies and shopping URLs on supported storefronts.

screenshot-to-pdf injects a Cloudinary image into the active page after each screenshot capture.

syncmarx uploads encrypted bookmark sync archives to the cloud using a bundled decryption key.

tb7.pl sends selected text or links and the current page's localStorage login value to tb7.pl when using its context menu.

text to speech ai sends app.scade.pro session cookie values to bot.izibit.net when that cookie changes.

The extension routes YouTube, Google and Telegram traffic through proxy servers listed in a remotely fetched configuration.

The extension saves VFS logins and applicant records into visa.vfsglobal.com localStorage.

The extension sends page URLs, referrers, and browser fingerprinting telemetry to p.baoyueai.com during UI actions.

잡큐브 원클릭DB 프로그램 sends active-tab HTML, the page URL, entered PII, and its API key to a configured HTTP server.

포인트백 for ADPICK sends visited page URLs to ADPICK's shopping-link endpoint when an ADPICK login or affiliate ID is present.

linkding extension sends active-tab URLs during opt-in precaching and can send API tokens over HTTP Linkding URLs.

Open In IINA injects page-controlled URLs into browser-executed JavaScript when opening media links.

Discord Token Login injects popup-entered token text into Discord pages through unsafely constructed script code.

AutoFormer+ stores visible form fields, including passwords, in each site's localStorage.

YouTube Comment Search sends YouTube video and search request details to a hosted YouTube proxy API.

URL Shortener sends saved Cutt.ly API tokens and long URLs to app.thebyteseffect.com when shortening links.

Superpower ChatGPT syncs ChatGPT conversation history and full conversation records to api.spchatgpt.com by default.

Pinned ChatGPT injects hidden affiliate iframes on whitelisted sites and sends the current site URL to trendupdeal.com.