Medium risk browser extensions

Y2Mate sends YouTube download requests with browser-generated authorization tokens to meowing.ssstik.art.

YouTube Video Downloader injects a remote S3 script into every matched webpage.

Google Image Search Right Click opens a cleartext Google image-search URL containing the selected image URL.

Magic CSS fetches Sass compiler JavaScript from cdnjs and injects it into the active tab in Chromium browsers.

Tipli do prehliadača uses remote instructions to read matching page text and send it to Tipli's add-on API.

SnapTube MP3 for YouTube Music Download adds YouTube download links that send video URLs to snaptube.audio over HTTP.

Circle reader sends account tokens and synced reading data to circlereader.com over cleartext HTTP.

Free Android online emulator ApkOnline sends non-ApkOnline tab URLs with a persistent user ID to www.uptoplay.net.

Capital Koala sends login credentials to its API with the password embedded in the request URL.

CPX Research Helper captures survey-tab screenshots, page HTML, and redirect URLs and sends them to log.cpx-research.com.

Best Pdf Manuals Hub sends each HTTP(S) page URL and title to cen.bestpdfmanualshub.com.

Wordtune sends readable page HTML, URL, and title from selected sites to its insights API.

GitLab Markdown Viewer renders local Markdown files with raw HTML that can run unstripped event handlers.

Rutor Torrent Search sends typed popup searches to Google Suggest and opens submitted searches over cleartext HTTP.

YouTube Video Downloader Pro sends its phone-download button to an unrelated campaign site.

Euskalbar sends dictionary search terms to several configured sites, including cleartext HTTP endpoints.

Blerp writes Blerp login tokens into twitch.tv localStorage after its Twitch login flow.

mail.com MailCheck embeds reusable OAuth client credentials and sends them in token requests for GMX, mail.com, and web.de accounts.

Tube Archivist Companion sends its API token and optional YouTube cookie export to user-configured HTTP servers.

LocalWeatherAlerts sends each completed page URL and tab context to its server for sponsorship responses.

Simple Form Fill can show saved form-fill snippets inside every visited page when autocomplete is enabled.

Torrent Finder Toolbar sends typed torrent search queries to Google Suggest over unencrypted HTTP.

1688 dropshipping pro can send full-page HTML from matched shopping pages to the ZQ Drop backend.

ABC Wallet stores wallet account approval globally, letting unrelated web pages read the approved account address.

AHi WhatsApp翻译[AI版] reads WhatsApp contact names and phone numbers and sends them to wstrans.890214.net.

AI Anywhere for ChatGPT removes anti-framing headers from AI provider subframes while its editor is open.

AI Assistant sends selected text, GPT-prefixed form text, and page URLs to its AWS GPT backend.

AI Diagram Generator includes a hardcoded OpenRouter API key for diagram generation requests.

AI Magic sends selected or typed page text with the stored account JWT and email to its GPT proxy.

AI Tab Master rewrites shopping links with affiliate IDs and asks tabcategory.ptsolutionsnz.com for promoted AliExpress URLs.

AITransDub sends subtitle text, your user ID, and the video page URL to its translation, TTS, and telemetry APIs.

AdGuard Home Control sends Basic-auth credentials to user-configured AdGuard Home URLs, including HTTP endpoints.

Agenda Hero for Chrome logs selected page content and screenshot prompts to Datadog before sending them to Agenda Hero.

AliFast sends AliExpress and Alibaba product URLs to alisave.info and redirects tabs to returned affiliate links.

AliImage Search routes AliExpress product and store clicks through an eshopwell.xyz affiliate endpoint.

AliPal sends clicked AliExpress product URLs to dailyfinds.xyz through an affiliate redirect.

AliSave redirects AliExpress and Alibaba product pages through affiliate endpoints after enhanced features are enabled.

AliSave rewrites AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

AliSave Pro routes AliExpress product and cart pages through an affiliate deep link.

Amazon Affiliate Link Generator sends the active Amazon page URL to amazonspot.net for link shortening.

Amazon Quick BSR Rank creates Firebase Auth accounts with a hardcoded default password.

Anime4K WebExtension can add permissive CORS headers to all media responses when its cross-origin fix is enabled.

Annotate Web stores page-specific drawing and text annotation history in each visited site's localStorage.

Apploye Time Tracker stores remembered login credentials encrypted with a passphrase shipped in the extension.

Arc Peek: Link preview removes CSP and X-Frame-Options headers so linked pages can load inside its preview iframe.

Arizona Helper by Sakai sends saved VK tokens and Discord webhook URLs to a complaint-transfer proxy.

Art New Tabs sends new-tab search terms to trends.search-hub.co when you press Enter.

Art Wallpapers New Tab sends typed new-tab search text to Mystart or SearchesSweet for search suggestions.

Aukcjoner.pl injects an Allegro SMS-code form into pages whose URL text contains allegro.pl.

Bancarios Profit sends CSGO.net item, roll, and invoice details to ludraapi.site services.

Black List Site 2 records full page URLs, page titles, visit counts, and time spent for sites you visit.

BlackTom AI sends quiz page URLs, cookies, page HTML, and configured LMS scrape results to htm88.org endpoints.

Download Bluesky videos from post URLs in MP4 or TS format.

书签地球助手 sends visited page URLs and titles to its statistics endpoint when record-visit mode is enabled.

Bot Assistant reads authToken values from the active page's localStorage for use in its side panel.

BybitEye sends Bybit P2P order, counterparty, chat card, and phone details to bybiteye.tradecode.tech.