Medium risk browser extensions

TM蛙 Temu image downloader sends the full URL of every page you visit to huoxiaqu.com.

CG No Login Master runs its popup script on every website visited, sending the page's origin and the user's IP to its vendor's server.

EdPro Circle sends the URL of every non-LinkedIn page you finish loading to mymosttrusted.net.

Right Click to Search sets chromecrxstore.com as the default search provider, receiving address-bar queries and suggestions.

The MBXtension sends the URL of each non-LinkedIn page you finish loading to mymosttrusted.net.

Wine online for Winapps sends the full URL of every page you open, plus the previous URL, to www.winfy.net.

Ali Lens records the URL, title, and time spent on every site you visit and sends it to fulhar.com.

DocCloud editor sends every page you navigate to, plus the previous page, to www.officloud.net.

Xooma Intelligence Disconnector reads your entire Facebook friend list and sends it to its own servers.

Automated App Coach captures webcam frames and page traffic on education sites and sends them to its AWS endpoints.

PptCloud sends the URL of one page you visit each day, plus the previous URL, to officloud.net.

Search Switch sets your default search engine to customserp.com instead of the Bing integration it advertises.

B Tools sends the logged-in WhatsApp user's name, phone number, email and country as a sales lead to two undisclosed third-party CRMs.

Play Games sets itself as the browser's default search engine on install and sends every omnibox search to onlinegamessearch.com.

28 Days Habit Tracker runs a bundled ZeroGPU compute SDK that registers your device with devices.zerogpu.ai by default.

Android developer Cordova online sends every URL you visit, hex-encoded, to www.uptoplay.net.

Real-Time Crypto Price Alert Tracker bundles the Mellowtel SDK, which can load server-chosen pages in hidden frames after opt-in.

Recipe Finder replaces the default search engine with chromecrxstore.com, labelled 'Internet'.

OfferAhead sends your live ChatGPT access token to its own server every time you open the popup.

PaintCloud sends the URL of every page you open, plus the previous URL, to officloud.net.

SnapCise fetches script URLs from a remote config and injects them into Instagram, YouTube and TikTok pages.

Tin sends the full URL of every page you visit to its own servers while you are signed in.

Cloud Music Web Player sets chromecrxstore.com as Chrome's default search provider, labeled 'Google'.

The extension sends every page URL you navigate to, plus the previous URL, to www.runapps.org once per day.

Trello Task Creator routes your full-access Trello token through a developer-owned webpage instead of Chrome's secure OAuth callback.

Find Real Friends reads the full text of your ChatGPT conversations and sends them to its own server.

Focus Flow bundles the Mellowtel SDK, which after opt-in loads server-chosen pages in hidden frames and uploads their content.

MINEUR2CREDITS UT-24 reads your EA session token and sends it to api.futfun.com when the server requests it.

Search by image on Amazon AZ sends the full URL of pages you visit to apiheaven.io and can redirect your tabs.

Web Guardian tracks every site you visit and uploads session, page-view, and on-page text data to its own servers by default.

ai-raindrop reads a 'token' value from localStorage on every website you visit and can send it to the extension's own server as your login.

Apollo Tab sends new-tab searches to its own server tagged with a persistent per-install ID instead of your default search engine.

Business Tools CRM reads your WhatsApp Web phone number and sends it with usage events to an Alibaba Cloud log service.

Clean for LinkedIn hands its own web app your LinkedIn session cookie on request.

Hypelio reads your LinkedIn session cookies to fetch your posts and analytics and sends them to its Supabase backend.

LeadMagnet Plus sends your WhatsApp number, profile name and Chrome email to wa-web-plus.web.app when WhatsApp Web loads.

Moneybelfort sends your WhatsApp number and Chrome profile email to aws-api-fp.averion.in on each WhatsApp Web load.

POUPE TEMPO SIMPLES ZAP loads a fingerprinting script from openfpcdn.io into WhatsApp Web pages.

WealthPipe sends the full URL of every site you visit or switch to to its own server, with no opt-in.

加搜GEO downloads JavaScript handlers from files.jiayisiyu.com and injects them into AI chat pages without integrity checks.

Council reads your ChatGPT, Claude and Gemini session cookies and sends them to its backend every 5 minutes.

CouponsMe fetches a domain list over plain HTTP and loads server-chosen URLs in hidden iframes on matching shopping sites.

Sales Boost Connect sends your WhatsApp number, profile name and Chrome email to wa-web-plus.web.app.

ZeWork Chat sends chat message text on chat.zework.com to Google Translate, MyMemory and OpenAI for translation.

Advanced Auto Logout ships a dormant tab-redirect module branded ‘Safety Redirector’ that isn't wired into this build's manifest.

Cashbe can disable other installed extensions, listed by a remote config, when a cashback offer is activated.

ChromeXT sends the full URL of each new site you visit to its servers and may trigger affiliate redirects.

ClicSight reads profile data from LinkedIn, CRM and webmail pages and sends it to app.clicsight.com for prospect lookup.

Coupert BR sends the full URL of every http(s) page you visit to its servers to look up coupons and cashback.

Coupert ES sends the URLs of all open tabs, in an obfuscated payload, to eventmonitoringpro.com on install and update.

Coupert RU sends a snapshot of shopping and checkout page contents to its own servers for coupon-field detection.

Datemyage Multiaccount downloads a script from its vendor's server and runs it on datemyage.com pages.

Download Templates fetches HTML from transitschedules.net once per profile and renders it unsanitised on the new tab page.

EE-Entry Filler loads a script from rch-en.netlify.app into rch.mohfw.gov.in pages and removes their security headers.

FortiEDR Secure Browser reads the plaintext username and password from every web form you submit, on any site.

Getquanty reads contact and company details from the pages you view and sends them to ext.getquanty.com.