Medium risk browser extensions

Ali Lens records the URL, title, and time spent on every site you visit and sends it to fulhar.com.

Automated App Coach captures webcam frames and page traffic on education sites and sends them to its AWS endpoints.

DocCloud editor sends every page you navigate to, plus the previous page, to www.officloud.net.

Android developer Cordova online sends every URL you visit, hex-encoded, to www.uptoplay.net.

SnapCise fetches script URLs from a remote config and injects them into Instagram, YouTube and TikTok pages.

Tin sends the full URL of every page you visit to its own servers while you are signed in.

Cloud Music Web Player sets chromecrxstore.com as Chrome's default search provider, labeled 'Google'.

PaintCloud sends the URL of every page you open, plus the previous URL, to officloud.net.

The extension sends every page URL you navigate to, plus the previous URL, to www.runapps.org once per day.

Find Real Friends reads the full text of your ChatGPT conversations and sends them to its own server.

Focus Flow bundles the Mellowtel SDK, which after opt-in loads server-chosen pages in hidden frames and uploads their content.

MINEUR2CREDITS UT-24 reads your EA session token and sends it to api.futfun.com when the server requests it.

Search by image on Amazon AZ sends the full URL of pages you visit to apiheaven.io and can redirect your tabs.

Web Guardian tracks every site you visit and uploads session, page-view, and on-page text data to its own servers by default.

ai-raindrop reads a 'token' value from localStorage on every website you visit and can send it to the extension's own server as your login.

Council reads your ChatGPT, Claude and Gemini session cookies and sends them to its backend every 5 minutes.

Hypelio reads your LinkedIn session cookies to fetch your posts and analytics and sends them to its Supabase backend.

加搜GEO downloads JavaScript handlers from files.jiayisiyu.com and injects them into AI chat pages without integrity checks.

CouponsMe fetches a domain list over plain HTTP and loads server-chosen URLs in hidden iframes on matching shopping sites.

Cashbe can disable other installed extensions, listed by a remote config, when a cashback offer is activated.

Coupert BR sends the full URL of every http(s) page you visit to its servers to look up coupons and cashback.

Coupert ES sends the URLs of all open tabs, in an obfuscated payload, to eventmonitoringpro.com on install and update.

Coupert RU sends a snapshot of shopping and checkout page contents to its own servers for coupon-field detection.

Datemyage Multiaccount downloads a script from its vendor's server and runs it on datemyage.com pages.

SaaS Security Scanner sends the URL, title and referrer of every page you visit to fulhar.com, on by default.

Cherry Pick sends the text of checkout pages, your email and saved cards to its Supabase backend.