Medium risk browser extensions

Magic list replaces your new-tab page and sends every search you type to rsrc-withus.com with fixed affiliate tags.

MagicSchool AI sends user action telemetry and auth session tokens to app.magicschool.ai on every interaction across all sites.

Netwrix Password Secure captures form fields including passwords on every page and fetches autofill configuration from netwrix.com on startup.

OptimAI Lite Node collects device fingerprints and reports uptime to api.optimai.network every 10–15 minutes in exchange for passive-income rewards.

PandaTab replaces your new tab with a full-screen iframe of tab.leisurelypanda.com and grants that remote page clipboard read access.

Pitch Changer sends session usage data including the origin of visited tabs to its own servers when server-side telemetry is enabled.

Plug transmits financial transaction details and a persistent user ID to Google Analytics, and exposes multiple third-party API keys in a web-accessible script any page can read.

Prime Video Speeder collects Amazon account details, email address, and viewing history and transmits them to me3x.online and metricsmint.quest.

Shopify Theme Detector sends periodic telemetry to Google Analytics and probes every website the user visits for Shopify store metadata.

Supademo records full DOM snapshots of pages you capture and sends debug logs with the active tab URL and account details to a third-party logger.

Tipli scrapes selected page text and sends it with the visited URL to www.tipli.cz.

Traffic Lite exposes JWT auth tokens in browser-history URLs and accepts storage-wipe commands from any Netlify subdomain.

Trim IMDB Rating sends your streaming page URLs, browsing metadata, and Netflix content details to its own servers and Google Analytics.

Universal Copy sends the hostnames of sites you visit, plus your IP, country and a persistent ID, to its Aliyun logging server.

VPN Japan - Planet VPN lite Proxy decrypts proxy credentials using a hardcoded key and can silently disable competing extensions.

Video Hunter Downloader collects your IP address and geolocation profile at startup and sends browsing activity to Google Analytics on every download and popup interaction.

Vimeo Downloader collects your IP, location, OS and a persistent device ID and sends them with usage events to an Aliyun log server.

Wanderlustar sets itself as your default search engine and routes every search through wanderlustar.com with a fixed affiliate tag.

Weatherly sends the user's IP address to ip-api.com over plain HTTP on install and every 25 minutes to resolve location for weather lookups.

StoryXpress Screen Recorder captures your screen, active tab, and webcam and uploads the video in chunks to its servers.

Widilo Cashback embeds a third-party coupon SDK that tracks users with a persistent UUID and sends browsing events to smartshopping.ai.

Windsurf Plugin transmits full editor text, file paths, and browsing context to server.codeium.com on each keypress in web-based IDEs.

Xiaohongshu for Desktop sends each post's ID and Xiaohongshu access token to a third-party server (api.old-panda.com) to fetch media.

uTab routes every new-tab search through search.utab.io with a persistent per-user id before redirecting to Bing.

Librezam sends audio fingerprint samples to an uncontrolled third-party Deno Deploy proxy and embeds recoverable API credentials in its bundle.

Alternate Player for Twitch.tv sends Twitch stream tokens, GPU fingerprint, and session logs to a third-party server over plain HTTP.

AliPrice runs on every website and sends the URL, title and referrer of each page you visit to Google Analytics and its own servers.

AliExpress Coupon Finder opens a hidden tab to the developer's AliExpress affiliate link, attributing your purchase commission to them.

Coursology sends selected text and tab screenshots to its AI API and stores user-uploaded files publicly on Vercel Blob storage.

CrapApi Http Test syncs your saved API requests, including headers and credentials, to its backend over unencrypted HTTP.

DownloadAs PNG JPG sends a persistent device UUID to Google Analytics every hour via a background heartbeat.

FadBlock Origin fetches its ad-detection rules from a remote GitHub Pages endpoint on install and update.

Shows how other news outlets cover the article you are reading.

IP Unblock VPN routes all browser traffic through a plain HTTP proxy with no encryption of its own.

Leetcode helper by labuladong places the user's labuladong site token into a LeetCode page iframe URL.

Locker sends every URL visited, the domain of each site, and product page details to its vendor servers across all websites.

Manga Translator sends a device fingerprint and base64-encoded image data to ichigoreader.com with every translation request.

Minea reads Facebook profile data (ID, name, city, birthday, gender) while browsing the Ads Library and sends it to data.minea.com.

Monosearch reads Amazon product and seller data from pages you view and forwards it to the vendor's mnsearch.com and mnrate.com backends.

OP_WALLET sends a persistent device ID and Bitcoin wallet address to its servers on every browser start.

OceanHero reads signed-in Google accounts and top-visited sites, and forwards your user ID to an ad network on every new tab.

Open in Foxit™ Reader passes web-origin PDF URLs to a native shell command without sanitization when a custom Foxit path is configured.

QuickForm Record Mode stores typed form values, including password inputs, in extension storage.

RoGold Ultimate transmits Roblox gameplay data to rogold.live every minute and loads remote CSS without integrity verification.

Scan WP sends the active tab URL to scanwp.net and renders the raw HTML response without sanitization.

Skins for YouTube receives CSS and image URLs from youtube-skins.com and injects them into YouTube pages, with the operator able to open new tabs remotely.

Snapchat Camera for Chrome reports per-site usage events and UI interactions to Snapchat's servers on every page visited.

TG DownloadHelper transmits the active tab URL, user email, and a persistent UUID to Alibaba Cloud on install, update, and each download action.