Medium risk browser extensions

WordPress Theme Detector sends the active site's hostname and IP address to ip-api.com over HTTP.

WriteMe.ai reads REACT_TOKEN_AUTH tokens from pages and sends them to apiv2.writeme.ai.

Yog B2B sends support-ticket details to Airtable and login auth keys to Procbee while embedding API credentials.

Youtube Timestamp Saver stores saved video thumbnail URLs that the options page requests from YouTube over HTTP.

Zid Sway3 replays Rosetta Stone API requests with modified progress and lesson-completion values.

beta工具 fetches remote Alibaba tool config, calls configured URLs, and sends encoded responses back to beta.alibaba-inc.com.

dict.cc context menu sends selected page text to dict.cc over an unencrypted HTTP search URL.

html.tomake.design (llama) lets any website trigger a page DOM capture into a downloaded .h2fig file.

iTracker: IG Unfollower Checker uses vendor rules to make Instagram API requests with your session data.

midjourney to notion sends saved prompt details and subscriber identifiers to gpts-api.gpt-stores.com.

The extension sends Wildberries seller supplier phone numbers and IDs to mphero.io weekly.

The extension sends Wildberries supplier phone contacts and old IDs to plugin.mpstars1.ru.

obsidian-livesync-webclip sends clipped page content and saved CouchDB Basic credentials to a configured database URL.

Đánh giá nhanh - DTU captures the visible MyDTU tab and sends the screenshot to Google Gemini for CAPTCHA solving.

VPN for Claude supplies proxy credentials to sites that request HTTP authentication.

SkyBridge supplies its proxy credentials to website authentication challenges while the VPN is connected.

云神价-购物点点 reads Weibo account IDs from open tabs and sends them to www.yunshenjia.com.

友鹰数据(Extension) fetches server-selected JavaScript and runs it on marketplace pages.

This academic search extension fetches remote config that controls background tabs and network rules on all sites.

智小抖 - 抖音AI全能助手 captures Douyin, Douhot, and Compass API responses and sends them to api.petslib.cn.

比特币行情 上班盯盘助手 sends bundled API keys to CoinGecko Pro and Mifengcha when fetching market and news data.

絶対に忘れないAI辞書 - ディクト sends DiQt API requests with an embedded Basic authorization credential.

锐达RCL-TK店铺运营AI助手 sends TikTok and Tokopedia seller cookies to twelve extension IDs every 30 seconds.

Simple Price Alerts loads affiliate tracking URLs on shopping pages and fetches remote boun.me rules that control page hooks.

Big Cupom redirects AliExpress pages through Awin with the full current URL in the affiliate request.

AdBlock Ninja reads your precise device location and sends it to its own servers during account signup and social login.

Prime/TalkyTimes/Amour ChatOS chats stores dating-site passwords, cookies, and refresh tokens in page localStorage.

English Popup Dictionary sends selected words, page URLs, IP addresses, and user agents to advertising services during lookups.

红鸟-X/推特下载助手 sends the full URL of every page you visit, on all sites, to plug2025.bm-com.com.

UTurbo sends the active tab URL and browser user agent to carbonvpn.tech when its popup opens.

CGI US Visa Appointment Auto Rescheduler stores your portal password and security answers in plaintext via Google Chrome Sync.

Android emulator MyAndroid reports every website you visit to its own server, once per day, keyed to a persistent per-install ID.

AI Platform captures your app.scade.pro login session cookie and sends it to a third-party tracking server.

Nike MeaVana sends the IP Info utility's public IP lookup to ip-api.com over cleartext HTTP.

MultiEye (+HTX) uploads P2P order records, counterparty details and card or phone numbers from exchange pages to tradecode.tech.

Adblock YouTube opens hidden affiliate tabs on ~11,000 partner sites, disguised to users as a tree-planting 'Eco Mode'.

Friend Requests Sender collects Facebook users' email, phone, address, and birthday from imported profiles, undisclosed in its listing.

SaleFlow reads Wildberries' own anti-bot session tokens from the page and sends them to its own backend on every API call.

Translate Webpage stores original page text and URLs in each site's localStorage after translating HTTPS pages.

FastProxy logs every site you visit and periodically sends the encoded browsing history to its own servers.

AutoSkipYT for YouTube posts Google or Bing search-page URLs to a remotely configured endpoint.

Unblocked Websites routes 100% of browser traffic through a hardcoded datacenter proxy, not just games or unblock sites.

Malus VPN sends the full URL and page title of every proxied tab to Google Analytics and its own backend.

Idle Forest bundles the Mellowtel SDK, which loads pages in a hidden tab and sends their content to Mellowtel's servers.

Clock, Alarm, Timer & Stopwatch bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames after opt-in.

Mitridat sends auction-site login names, bids and page visits, with IP location, to auctiongate.io.

1Click Safe Browsing sends every page you open, with headers and page title, to its own servers.

Adblocker X fetches addonsrv.net rules that can inject controller iframes into matching websites and alter page content.

Busca Milhas keeps a WebSocket open to its server and makes HTTP requests from your browser on the server's command.

iGive Button initializes PostHog analytics with autocapture on every page you visit, not just cashback merchant sites.

PriceBlink runs vendor-served, per-retailer config strings as page-context JavaScript during its auto-coupon flow.

Talia reads your LinkedIn session cookies and sends them to its vendor backend, and collects candidate data from recruiting and email pages.

eimmigration CBP Importer fetches a script from eimmigration.com and runs it in the active tab's page.

Vocabulary builder injects a remote vocabulary.live sidebar into any site, giving it read/write access to the page and its local storage.

APP For IG DM sends your Instagram CSRF token and inbox data to an Alibaba Cloud analytics backend during auto-reply.

Mail Seen sends the full body text of each outgoing Yahoo Mail message to its own server.

SavvyConnect streams every page you visit, plus raw request/response headers including cookies, to Luth Research.