Medium risk browser extensions

Bex Auto uploads all manheim.com cookies to auctiongate.io and routes auction traffic through a vendor proxy.

LinkedIn Video Downloader sends your signed-in Chrome profile email to app.soletstalkapp.com each time the popup opens.

Qwen Reader runs text-to-speech through the user's own chat.qwen.ai session by intercepting requests on that site.

WA Privacy reads your WhatsApp number and sends it with a persistent device ID to a third-party analytics endpoint on every logged event.

QR Code Generator & Reader bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames on your connection after opt-in.

iFoxTab sends a record of the pages you visit, with a device ID, to ai.flolight.cn.

Auction Manager sends your Copart session cookies to carhunters.com every 10 seconds and proxies auction traffic.

News New Tab routes search queries and news requests through third-party domains tied to a publisher affiliate key.

Next Level Networking Community sends the URL of every non-LinkedIn page you load to mymosttrusted.net.

Video Speed Controller bundles the Mellowtel SDK, which after opt-in loads server-chosen pages using your browser.

BizLead Pro sends your Chrome profile email and WhatsApp phone number and name to wa-web-plus.web.app on WhatsApp Web load.

Taobao Shopping Cart Assistant uploads product page details from 30+ marketplaces to index.aiprice.com as you browse.

Behavix fetches a server-controlled config per site that can capture network traffic and DOM content, then uploads it to its own servers.

AiGrid records everything shown and typed in its own pages and sends it to tglens.tabgraf.com.

Ninja Connect Network sends the URL of each non-LinkedIn page it can see to mymosttrusted.net, with your profile ID.

Lighthouse's new-tab search box labelled Bing sends every query to the affiliate-tagged portal www.msearch.co.

WAPP Group Link Generator sends your signed-in Chrome profile email to app.soletstalkapp.com each time the popup opens.

Wise Owl sends your Chegg login session token to unblur.top and related servers when fetching solutions.

Telegram desktop online sends the full URL of each page you navigate to, plus the previous URL, to runapps.org daily.

Monitix embeds the Mellowtel SDK, which loads server-chosen URLs in hidden iframes after the user opts in.

Flashing News & Search replaces the new tab page and routes all searches and news fetches through its own servers using a hardcoded publisher key.

MailTwig records full DOM snapshots, typed input and mouse events on its pages and sends them to tglens.tabgraf.com.

Global Tech Mass Message Sender reads your WhatsApp Web phone number and sends it to its own backend.

The TikTok downloader sends the URL and host of every page you visit to plug2025.bm-com.com.

Amazon Keyword for Seller fetches server-chosen URLs from your browser and sends Seller Central brand reports to its servers.

Blender 3D creation suite sends the hex-encoded URL of your page navigations to www.runapps.org, about once per day.

Unicorn Universe sends the full URL of every page you finish loading to mymosttrusted.net.

Academic Search Navigator sets chromecrxstore.com as the default search provider, labelled 'Google'.

GPT Defender reads your full ChatGPT conversation history and uploads it to telemetry.mainnet.bls.dev every 30 minutes.

Attach Files as PDF reads every signed-in Google account email on Gmail load and sends the list to cloudHQ.

Notepad++ online sends each top-level page URL and the previous URL, hex-encoded, to www.winfy.net.

Tabblar redirects visits to 14 brand sites to the developer's referral links, once per 24 hours per site.

The extension sends every page URL you navigate to, plus the previous URL, to www.winfy.net once per day.

Waldo opens a server-controlled channel that fetches arbitrary URLs with your cookies and browses in background tabs.

Jobright Fraud Detection reads candidate PII from ATS pages and sends it to Jobright's servers for a fraud score.

LibreOffice Draw online sends the URL of every page you open, plus the previous URL, to www.runapps.org.

Merry Christmas Card Templates reads every Google account email signed in to the browser and sends the list to cloudHQ.

VCU records the URL, title, and search terms of every page you visit and writes them to a database other logged-in users can read.

Apache Cordova online CordovaIDE sends each top-level page URL and the previous URL to www.myandroid.org once a day.

FortiEDR Secure Browser reads the plaintext username and password from every form submitted on every site.

Network Defence fetches an affiliate store list from its server and opens hidden affiliate links on matching sites.

Web Scraper Pro sends your Chrome profile email and scraped page URLs and titles to chatph.thinksolv.com.

Calculator Plus bundles the Mellowtel SDK, which loads server-chosen pages in hidden iframes after an opt-in.

Emitrr dev sends full page HTML to a third-party AWS endpoint when its contact scanner can't match a name, on any site you visit.

Chroma Color Picker bundles the Mellowtel SDK, which loads server-chosen URLs in hidden frames after an opt-in.

AR Wp Detector reads your signed-in Chrome profile email and sends it to api.wpoptic.com on startup.

Desktop for Tiktok online sends every page URL you visit and the previous URL to www.runapps.org.

The Operators Trusted Network sends the URL of each page you finish loading on its permitted sites to its own server.

Full Page Capture bundles the Mellowtel SDK, which loads server-chosen URLs in hidden frames and returns page content.

LinkMatch for Copper copies LinkedIn profile, messaging and search API responses and uploads them to linkmatch.com.

LibreOffice Impress online sends each page you visit, with the previous page, to runapps.org once a day.

Spotify Web Player Search sets chromecrxstore.com as Chrome's default search provider.

Ad Blocker for Chrome reads Google Search ads and your search query and sends them to newbackend.ads-collect.com.

GoJo Shipping sends Copart and IAAI login usernames with IP and location details to its vendor backend.

Kdenlive video editor sends the hex-encoded URL of each page you navigate to, once a day, to runapps.org.

SiteShield sends the full URL of every page you load to plug2025.bm-com.com, whether or not it is blocked.

Vebiz Eklenti lets pages on vebiz.com.tr open any URL in a new tab and run supplied script code there.

AI翻訳 (JATranslator) sends the URLs of every open browser tab to its own servers during meetings and whenever its popup is opened.