Medium risk browser extensions

This extension helps you keep track of upcoming TV shows and movies.

Pragmaz for Whatsapp strips WhatsApp Web's security headers network-wide and routes its traffic through a shared proxy password.

RightInbox connects Gmail pages to RightInbox and Mailshake services for reminders, tracking, templates, and notes.

Roblox Friend Remover Button modifies Roblox purchase pages to promote RoEarn and roexport redirects.

Subtitles for Language Learning stores OpenSubtitles credentials using a passphrase bundled with the extension.

This extension receives browser notifications from a paired Synology DiskStation NAS.

Tabs Outliner sends a SHA-1 hash of the Chrome profile email to FastSpring during purchase checkout.

Vue.js devtools forwards captured timeline screenshots into the inspected page through a window.postMessage bridge.

WaSeller stores your WhatsApp and Google login tokens in the page's IndexedDB, "encrypted" with a key hardcoded in its own code.

Web Paint Tool stores page drawings in each website's localStorage where that site's scripts can read them.

YouTube Tags sends YouTube watch-page video IDs to Google Analytics with a persistent extension UUID.

SingleFile bundles hardcoded OAuth client secrets for Google Drive and Dropbox, and a hardcoded Woleet API bearer token, in its source.

AdLibNote intercepts Facebook session tokens and GraphQL request data and transmits them to denote.net.

Browser-Surf replaces the new tab page with a search form that forwards every query to browser-surf.xyz with an affiliate tracking ID.

Manages multichain crypto activity across EVM networks, TON, NEAR, Solana, Stellar, and TRON.

Track job applications and autofill online application forms from your Huntr profile.

I.CA PKI Service Component accepts cookie-read requests from third-party web pages and forwards retrieved banking-domain cookies to a native host application.

Mochi Dictionary Extension ships a static Mochidemy API key used for dictionary and profile API requests.

This extension tests available Shein discount codes at checkout and applies the best one to your cart.

Mendeley Web Importer sends analytics with your IP address and device fingerprint to New Relic, Adobe Analytics, and Mendeley.

User-Agent Switcher and Manager fetches its agent list from cdn.jsdelivr.net at an unpinned @latest reference with no integrity check.