Medium risk browser extensions

Generates AI comment suggestions for LinkedIn posts based on the user’s profile, tone, and settings.

Discord Token Login signs into Discord from a pasted session token, writing it into local storage and skipping the password and 2FA prompt.

Digital Titans sends your Etsy session cookies to its own server every time you search a keyword.

Fob reads your full LinkedIn cookie set, including the li_at session cookie, and writes it into a form field on the vendor's own site.

Lockcard sends dictionary and translation requests to DeepSeek with a bundled API bearer token.

Friend Ejector reads your entire Facebook friends list and uploads it to its own backend server.

LoveDeals silently opens a hidden background tab through its own affiliate link on merchant sites you visit organically.

Clyck List reads your LinkedIn session cookies and sends them to its own backend to replay your login.

SERP Analyzer sends the hostname of every site you visit and your IP address to third-party servers on each page load.

AI Translator sends the URLs of every open browser tab, across all windows, to JotMe's servers on popup open or Google Meet calls.

BrowseHero sends the URL and title of nearly every page you visit to its own server and can overlay ads or open tabs based on the response.

SL Sender bundles an affiliate SDK that watches every site you visit and opens background tabs to inject affiliate cookies when shopping.

Console Poly sends the class roster and attendance record to a Google Form and its own server on every attendance submission.

WA Privacy reads your WhatsApp number and sends it with a persistent device ID to a third-party analytics endpoint on every logged event.

News New Tab routes search queries and news requests through third-party domains tied to a publisher affiliate key.

Behavix fetches a server-controlled config per site that can capture network traffic and DOM content, then uploads it to its own servers.

Flashing News & Search replaces the new tab page and routes all searches and news fetches through its own servers using a hardcoded publisher key.

GoGPT monitors every page you visit and can silently redirect your active tab based on a remote command.

VCU records the URL, title, and search terms of every page you visit and writes them to a database other logged-in users can read.

FortiEDR Secure Browser reads the plaintext username and password from every form submitted on every site.

Emitrr dev sends full page HTML to a third-party AWS endpoint when its contact scanner can't match a name, on any site you visit.

AI翻訳 (JATranslator) sends the URLs of every open browser tab to its own servers during meetings and whenever its popup is opened.

CG No Login Master runs its popup script on every website visited, sending the page's origin and the user's IP to its vendor's server.

Ali Lens records the URL, title, and time spent on every site you visit and sends it to fulhar.com.

Xooma Intelligence Disconnector reads your entire Facebook friend list and sends it to its own servers.

Search Switch sets your default search engine to customserp.com instead of the Bing integration it advertises.

B Tools sends the logged-in WhatsApp user's name, phone number, email and country as a sales lead to two undisclosed third-party CRMs.

Play Games sets itself as the browser's default search engine on install and sends every omnibox search to onlinegamessearch.com.

OfferAhead sends your live ChatGPT access token to its own server every time you open the popup.

Trello Task Creator routes your full-access Trello token through a developer-owned webpage instead of Chrome's secure OAuth callback.

Find Real Friends reads the full text of your ChatGPT conversations and sends them to its own server.

Web Guardian tracks every site you visit and uploads session, page-view, and on-page text data to its own servers by default.

ai-raindrop reads a 'token' value from localStorage on every website you visit and can send it to the extension's own server as your login.

Apollo Tab sends new-tab searches to its own server tagged with a persistent per-install ID instead of your default search engine.

Clean for LinkedIn hands its own web app your LinkedIn session cookie on request.

WealthPipe sends the full URL of every site you visit or switch to to its own server, with no opt-in.

Advanced Auto Logout ships a dormant tab-redirect module branded ‘Safety Redirector’ that isn't wired into this build's manifest.

FortiEDR Secure Browser reads the plaintext username and password from every web form you submit, on any site.