Medium risk browser extensions

YouTube Mini Player generates a persistent device fingerprint and sends it with every request to the developer's server.

CFCA CryptoKit.CIB Extension forwards caller-supplied native host names without validation, allowing any authorized origin to connect to arbitrary native messaging hosts.

CJDropshipping stores your raw account password in Chrome sync when remember password is selected.

ClearTok sends your TikTok username and repost-removal activity to its own servers via a session-based tracking system.

CocoShot lets any website request and receive your camera and microphone device list through its permissions page.

Devolutions Workspace reads form fields on every page to autofill saved logins, and ships hardcoded credentials for its telemetry server.

EXIF Viewer Pro sends Flickr photo IDs to api.flickr.com over HTTP when you request EXIF data for Flickr images.

Free Vimeo Downloader sends a persistent UUID and usage events to Alibaba Cloud logging infrastructure on install and download actions.

LockSelf Professional Password Manager intercepts outgoing request bodies on every website to detect and capture username and password pairs.

MAL-Sync fetches remote configuration from chibi.malsync.moe to determine which anime sites receive dynamically registered content scripts.

SAFEQ Cloud ships a Playwright testing backdoor in production that any Chrome extension can use to disable authentication or spoof identity.

Screenshot YouTube Video sends the current page URL and a persistent browser ID to api.videodlservice.com daily.

TON Wallet injects a wallet provider into every page that can return the logged-in TON address and balance.

Titans Quick View sends Amazon search cookies and a browser fingerprint to Self Publishing Titans for BSR results.

dataslayer forwards tag-management data from every inspected frame to the frame's parent page.

Amazon Order History Reporter transmits an RSA-encrypted user email and order metadata to the developer's server on each order history scrape.

Browser-Surf replaces the new tab page with a search form that forwards every query to browser-surf.xyz with an affiliate tracking ID.

The extension mints a token from your Crunchyroll session and sends your watch history, profiles, and subscription data to me3x.online.

DeepTranslate routes all translated page text through its own proxy server and tracks each installation with a persistent UUID sent on every request.

EuroSaver sends the Amazon marketplace country from product pages to eurosaver.net for banner selection.

Free VPN - Super routes all your browser traffic through operator-supplied proxy servers configured from the vendor's remote API.

Krisp records Google Meet call audio and transcripts and uploads them to Krisp's servers, and rewrites YouTube's content-security-policy.

Net iD Client bridges web pages to a local native app without validating message origins, allowing any page script to relay requests and receive responses.

Netflix Extended transmits a persistent user ID to gathering.solutions and lets svodextensions.com request broad browser permissions.

Pague Menos Be!Tech can collect page DOM and script values and send them to paguemenos.betechers.com.br.

Paint Tool for Chrome saves your drawings and text into each website's localStorage when you use its overlay.

Record Google Meet sends your Google account email and IP address to app.easymeetrecord.com for subscription and geo-based paywall checks.

SVG Gobbler sends SVG markup to a remote cloud function when converting to JSX, and transmits a usage counter to the same endpoint on each gobble action.

Screen Ruler exposes its stable extension ID in page-visible DOM markers when the ruler is activated.

SmartOn ID Pass Extension encrypts native messaging traffic with a hardcoded AES-256 key, exposing credentials to any local process.

TwiHD Twitch 1080p routes browser traffic through remotely-configured proxy servers and transmits device identifiers and IP addresses to its backend.

XTranslate sends translated text and a persistent installation UUID to its own servers and usage events to Google Analytics.

Snipo transmits a persistent user UUID and IP address to Mixpanel on every page load across all websites.

ySense Addon fetches account and notification data from addon.ysense.com over plaintext HTTP.

Эй Бро ChatGPT helper transmits all chat conversations, including attached screenshots, to its own backend server at ai-backend.heybro.ai.

CatalyzeX sends page URLs, paper titles, and arxiv IDs to its servers on every academic page visit, and links this activity to authenticated user accounts via Mixpanel.

AODocs Smartbar stores a live Google Drive OAuth token in session storage accessible to untrusted page scripts on Google Drive, Docs, and Gmail.

AliDropship 2.0 sends AliExpress product data and order details to its own servers and a third-party GraphQL endpoint.

AliScraper reads authentication tokens from dsers.com pages and forwards them to ac.dsers.com to retrieve product listings for bulk import.

Altair loads third-party plugin code from cdn.jsdelivr.net or a user URL and runs it with access to your GraphQL queries and auth headers.

Discord Token Login sends paste-event telemetry with the active tab hostname and field tag to its analytics proxy.

On 'Send debug data', the extension sends its entire local storage, including stored Google OAuth access and refresh tokens, to its server.

IPRoyal Proxy Manager sends a persistent device ID and hashed user ID to Google Analytics on login and other events.