Medium risk browser extensions

Shotcut online video editor sends every visited URL and download to runapps.org and can redirect the tab based on the server's reply.

HTML editor WebStudio for Webpages sends the URL of every site you visit to a tracking server on each tab switch.

Wukong AI Search fetches remote config that installs network rules and opens server-chosen tabs on each multi-search.

Email GIFs reads every signed-in Gmail address and sends the list to cloudHQ's servers.

BDRIS Reporting Tool scrapes citizens' National ID and MyGov profile data and sends it to the vendor's own server unconditionally.

Adobe Bulk Download sends Chrome account identifiers to a license server during startup license checks.

Labs Token PRO captures Google OAuth Bearer tokens from every website visited, not just labs.google, storing the last 5 unencrypted locally.

Simple Audio Voice Sound Recorder sends every visited URL and its request headers to cs.bkp.v1.fsdifhj.com after a consent click.

Local Video-Audio Player sends visited URLs, page titles and request headers to a remote verification server after opt-in.

Coupons.com collects hotel booking details, including guest name and email, from confirmation pages and sends them to Directo.

Perplexity Exporter accepts account updates from any extension with no sender check, letting one forge its cached subscription data.

Tabtiby sends the active tab's full URL, IP address and a persistent ID to an Alibaba Cloud logging endpoint.

Highlightion accepts your Notion login token from a local port with no origin check, and sends every page you visit to Google Analytics.

Portal Link Generator sends your Bybit and MEXC identity-verification session tokens to a third-party server.

Amazon Coupon Auto-Apply rewrites the affiliate tag on Amazon page loads using a tag fetched from couponhacker.xyz.

NetVerify Suite downloads declarativeNetRequest rules from its own server and applies them without validation.

LinkMatch for Close copies LinkedIn profiles you view and uploads them to its servers, and scrapes profiles on server request.

Music Downloader | VK Music Saver silently sets devicereset.online as the browser's default search engine on install.

ChatGPT Assistant - GPT Search sends everything you type into Google, Bing and other search engines to a third-party server, not to ChatGPT.

LinkMatch for CSV copies LinkedIn API responses, including private messages, to app2.linkmatch.com as you browse.

Messenger Central sends new-tab search queries to srchms.com with a fixed affiliate identifier.

Video converter online VideoConvertPlus reports every .html/.xml page you visit to its vendor's server and can open a new tab in response.

Forwarded Email Importer by cloudHQ reads every signed-in Google account email on Gmail and sends the list to cloudhq.net.

The extension sends the full URL of every page you navigate to, plus the previous URL, to www.winfy.net once a day.

Unblock Proxy routes all of your browser traffic through a hardcoded third-party proxy once its toggle is switched on.

Reffer App fetches a server-assigned target URL and CSS-selector schema, then crawls and scrapes up to 500 pages on any site.

Email File Request reads every signed-in Google account email on Gmail and sends the list to cloudHQ.

Apple TV Search replaces Chrome's default search provider and sends address-bar searches to chromecrxstore.com.

DivMagic sends a screenshot and the HTML/CSS of each element you select to its servers after a 10-second delay.

Orso writes each WhatsApp recipient number and message text, plus your own number, to its Firebase database on every send.

Email Search and Outreach by Sprouts captures your live LinkedIn session cookies and sends them to its own backend.

Shepherd records page content and sessions on every site and sends them to Composite's servers.

SSHGate sends the address of every .html or .xml page you open to redcoolmedia.net.

Image Downloader Assistant bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames and uploads their content.

VPN for Notion fetches its proxy server credentials from unauthenticated GitHub, Blogspot, and Google Docs pages with no integrity check.

Photo editor PhotoStudio sends every http(s) URL you visit to stream.redcoolmedia.net with a persistent random ID.

UAR_SKI_V2P monitors every page you visit and sends the URL to a native application when it detects a marker element.

NewTab downloads code from api.newtab.com on every new tab and runs it in an interpreter over the page's window.

beta工具 sends the active tab's hostname to beta.alibaba-inc.com and runs server-specified requests with its all-sites access.

XlsWork sends the URL of every web page you visit, hex-encoded with a per-install ID, to stream.redcoolmedia.net.

Pragmaz loads encrypted JavaScript hidden in PNG images from pragmaz.ai and runs it inside WhatsApp Web.

Cleaner History Browser reports every visited URL to its servers and opens affiliate links in hidden tabs on shopping pages.

Автоотклики на HH — HeadHunter sends saved Telegram usernames to a TributeManager access-check API.

Hagro reads your full LinkedIn cookie jar, including the session-auth cookie, and exposes it to its own site.

DocsWork Editor sends every http(s) URL you visit, hex-encoded with a persistent ID, to stream.redcoolmedia.net.

Pague Menos Be!Tech loads a remote config on every site that can send page content, page variables, and cookies to its own server.

Backup Emails to AWS S3 reads every signed-in Google account email on Gmail load and sends the list to cloudHQ.

TransTik captures TikTok feed, search, like and favorite video lists and uploads them to kolsprite.com.

LinkMatch for Zoho Bigin sends LinkedIn profile, inbox and search API responses to app2.linkmatch.com as you browse.

FDev Security sends the hostname of every site you visit to its developer's own server, with no way to turn it off.

SLTD sends your Chrome email, WhatsApp phone number and profile name to wa-web-plus.web.app on WhatsApp Web load.

Movie maker MovieStudio sends the full URL of every web page you visit to stream.redcoolmedia.net.

Chatgpt Unblocked routes chatgpt.com and any site you add through fixed proxy servers using one hardcoded login shared by all installs.

InboxApply autofills job applications and sends form data and a screenshot to developer Discord webhooks when errors occur.

Vinted Checker sends the full URL and page content of every product page you visit to its own servers, contradicting its privacy policy.

Secure Document Sharing by cloudHQ reads the email of every signed-in Google account on Gmail and sends the list to cloudHQ.