Medium risk browser extensions

Undo Closed Tabs bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames and uploads their content.

Boss Plus fetches a proxy script from yiban.io and can set it as the browser-wide Chrome proxy.

Discord Token Login signs into Discord from a pasted session token, writing it into local storage and skipping the password and 2FA prompt.

FreeexpressVPN Chrome has no VPN/proxy function and sends the active tab's URL to a third-party geolocation API on every popup open.

Alarm, Timer & Stopwatch bundles the Mellowtel SDK, which after opt-in loads server-chosen URLs in hidden iframes.

Privacy Extension for WhatsApp fetches a remote config from waplus.io that drives promotional banners and dialogs in WhatsApp Web.

KittyCursor bundles GiveFreely affiliate code that runs on every page and reports the URLs you visit to events.givefreely.com.

The extension sends the host and full URL of every page you visit to huoxiaqu.com.

Video editor VideoStudio sends the URL of each web page you visit, hex-encoded, to stream.redcoolmedia.net.

The extension takes commands from viewgrip.net to like, subscribe and comment on YouTube from the user's logged-in account.

Calculator Extension redirects visits to server-listed sites and rewrites clicked links through a remote-chosen URL.

Kendo-Linkedin Email Finder auto-pages LinkedIn search results and uploads every listed member's profile data to its own server.

Social Lead Extractor uploads scraped Instagram profiles, including emails and phones, to the vendor's own server.

Generates AI comment suggestions for LinkedIn posts based on the user’s profile, tone, and settings.

Mail Seen sends the full body, sender, recipient and subject of Outlook emails to its server when you click Send.

Unfugly sends your SRM Academia cookies and student records to its own backend on onrender.com.

Free Windows online emulators sends the full URL of every page you visit to www.onworks.net.

FunFluen sends your ChatGPT session token to its own testi.appforlanguage.com server with each AI chat request.

阿蛙 sends the host and full URL of every page you visit to plug2025.bm-com.com.

Digital Titans sends your Etsy session cookies to its own server every time you search a keyword.

MultiEye uploads P2P order records, counterparty identities and payment requisites from exchange pages to multi.tradecode.tech.

Save Emails to Egnyte lists every signed-in Google account email and sends it to cloudHQ when Gmail loads.

Back up emails to SharePoint sends the list of all signed-in Google accounts to cloudhq.net when Gmail loads.

LinkMatch for Insightly captures LinkedIn profile, messaging and search API responses and uploads them to app2.linkmatch.com.

Fob reads your full LinkedIn cookie set, including the li_at session cookie, and writes it into a form field on the vendor's own site.

LibreOffice writer online sends every page you navigate to, hex-encoded with a persistent ID, to www.runapps.org.

Lockcard sends dictionary and translation requests to DeepSeek with a bundled API bearer token.

Friend Ejector reads your entire Facebook friends list and uploads it to its own backend server.

LoveDeals silently opens a hidden background tab through its own affiliate link on merchant sites you visit organically.

Unblocked Games routes five game and site domains through hardcoded third-party proxy IPs when the user turns the proxy on.

Clyck List reads your LinkedIn session cookies and sends them to its own backend to replay your login.

Download Files as PDF reads all signed-in Google account emails in Gmail and sends them to cloudHQ every two weeks.

K dropshipping pro sends the full HTML of pages matching a server-supplied list to its vendor backend.

The extension sends the hex-encoded URL of every web page you visit to www.onworks.net.

SERP Analyzer sends the hostname of every site you visit and your IP address to third-party servers on each page load.

INTERALEX uploads all manheim.com cookies and Copart/IAAI login usernames to auctiongate.io.

AI Translator sends the URLs of every open browser tab, across all windows, to JotMe's servers on popup open or Google Meet calls.

Manage WhatsApp Inbox sends your WhatsApp number and each bulk message's recipient, text and active tab URL to its Firebase backend.

The extension runs JavaScript sent by its vendor's server inside pages and returns cookies and localStorage on request.

Ubuntu online linux server sends the address of every web page you visit to www.onworks.net.

BrowseHero sends the URL and title of nearly every page you visit to its own server and can overlay ads or open tabs based on the response.

PaintMagick sends the URL of every HTML, XML and image page you open to redcoolmedia.net.

SL Sender bundles an affiliate SDK that watches every site you visit and opens background tabs to inject affiliate cookies when shopping.

Console Poly sends the class roster and attendance record to a Google Form and its own server on every attendance submission.

Carex Auto sends Copart and IAAI login usernames, with IP and location, to auctiongate.io for guest users.

Chegg Expert Answer Link Finder sends the popup's rendered Chegg answer list and expert ID to vipsolutions.in.

PPTWork sends every top-level page URL you visit, with the previous URL, to redcoolmedia.net.

LibreOffice Calc online sends the hex-encoded URL of every page you open, plus the previous URL, to www.runapps.org.

AudioStudio sends the full URL of every web page you visit, hex-encoded with a persistent ID, to stream.redcoolmedia.net.

BattlePass.ru appends your Twitch login cookie to playlist requests sent to tw2.finargot.ru.

Handbrake - video converter sends the URL of every page you open, plus the previous URL, to runapps.org.

XlsCloud sends the URL of every page you visit, plus the previous URL, to officloud.net.

ZIZ WhatsApp CRM sends your CRM data and uploaded files to a third-party backend, crmwhatsappred.toolscrm.com.

Online Reading Bookcase embeds a vendor-hosted iframe on every page and sends it the page's URL and title.

USA Coupons, Deals, Promo Codes Search replaces your default search engine with chromecrxstore.com.

COOKmate sends every cookie for the active tab's site, plus its URL, to www.cookmate.online.

RAM Shipping sends all manheim.com cookies and Copart/IAAI login usernames to auctiongate.io.