Medium risk browser extensions

Toby Mini sends open tab URLs and saved bookmark data to its servers when AI features are used.

Urban AdBlocker sends URLs, page titles, referrers, and request metadata from visited pages to Urban VPN.

The extension decrypts proxy credentials with a hardcoded AES key and can disable other installed browser extensions.

Voice Out reads the page text or selection you ask it to speak and, on the default free voice, sends it to Google Translate's internal RPC.

Web Maker syncs user code to Firebase and a multiplayer backend, and sends behavioral telemetry to a Google Cloud Run endpoint.

YouTube Subtitle Downloader generates a persistent browser fingerprint and sends video IDs and user actions to the developer's server.

iTour Video Translation captures audio from the current tab, screen, or microphone and streams it to Alibaba Cloud and Microsoft speech services for transcription.

Shinigami Eyes collects surrounding post DOM from social media pages and transmits it to shini-api.xyz when a user labels an account.

ZenMate Free VPN sends the user's real IP address and location to a third-party geolocation service on install.

1of10.com - Optimization Tool For Youtube assigns a persistent device ID and transmits it with browsing analytics to 1of10.com servers.

AIPRM for Claude intercepts outgoing Claude conversation requests and transmits the user's account UUID to api.aiprm.com on every visit.

Add to Microsoft To Do stores Microsoft OAuth tokens in sync storage encrypted with a hardcoded AES key bundled in the extension source.

AdsMeta reads your Facebook ad-account access token from facebook.com and shares it with its own adsmeta.io dashboard.

SellerApp's keyword tool silently scrapes your Amazon Seller Central Brand Analytics data and uploads it to SellerApp's servers.

Anime Cursor fetches remote cursor URLs from api.gameograf.com on every popup open and injects them unsanitized into CSS on all web pages.

AutoDS - Dropshipping Helper intercepts XHR traffic and request headers on supplier sites and sends AliExpress product URLs to a third-party server for affiliate link rewriting.

Axhub accepts page-supplied URLs to fetch and execute remote JavaScript in any open tab via chrome.scripting.executeScript.

Batch Upload Tool sends page URLs, device identifiers, and IP addresses to events.sellfox.com on every product scrape action.

BeeLine Reader sends the full URL of each active page to Google Analytics via a tracking pixel for free and trial users.

Bright Tab routes every new-tab search query through its own server with a persistent user ID and a server-assigned secret token.

CCH® Browser Search transmits search queries and a user identifier to cchconnect.cch.com on every Google, Bing, and Google Scholar search.

CMS Detect sends the active tab's URL to cmsdetect.com over plaintext HTTP each time the popup is opened.

ChemDraw Web Clipboard bridges clipboard requests from any webpage to a local native messaging host on the user's machine.

Clarify AI sends YouTube transcripts and Google OAuth codes to its own backend, which may retain persistent Google refresh tokens.

Companion Window sends the full URL of pages you visit plus a persistent user ID to GiveFreely's analytics server when its review prompt fires.

Create Link executes user-defined JavaScript in the content script context on every page visited when a custom format filter is set.

Crunchyroll Speeder exchanges your Crunchyroll session cookies for an OAuth token and reads your account, history, and subscription data.

Dashlinks - New Tab replaces the browser's new tab page and sends every search query to search4it.net along with the extension ID and version.

Debrid-Link renders notification details into every HTTP/HTTPS page where page scripts can read them.

Designer Daily Report exposes a postMessage handler that any webpage can use to open arbitrary tabs without origin validation.

Dice Thrower fetches a remote HTML snippet from cameronsamuels.com and injects it into the popup via innerHTML on every open.

Dupe.com sends the URL and product metadata from every HTTPS page you visit to Google Analytics.

Easy Web Data Scraper automatically collects Temu product data and forwards it to temuhunt.com during the user's browsing session.

EasyClaw Browser Assistant lets a localhost relay send Chrome DevTools commands through the extension.

Engage AI sends LinkedIn cookies and profile details to Engage AI backend endpoints.

Equicord Web loads QuickCSS editor code from cdn.jsdelivr.net while removing Discord content-security-policy headers.

Extension Club R reads the Rakuten auth cookie and sends the decoded member ID to Google Analytics on user interaction events.

Footballguys Extension: Manage My Leagues sends fantasy-site cookies to Footballguys pages on request.

Get Maps & Directions sets getdirectionsmaps.com as the default search provider and sends address-bar searches there.

Google Apps Script GitHub Assistant ships hardcoded Bitbucket OAuth2 credentials that any party can extract from the extension bundle.

Google Pagespeed Insights ships hardcoded SMTP credentials and fetches remote-controlled HTML ads into its popup on every open.

Google Translate Assistant sends page URLs, device identifiers, and tab screenshots to its vendor servers during normal use.

HAVAH Wallet sends wallet interaction events (connect, sign, transaction URLs) to Google Analytics with a persistent client UUID.

HTML to PDF generates a device fingerprint on each popup open and transmits it with geolocation data to hub.malson.eu.

IOTA Wallet sends detailed financial activity events — transactions, DApp connections, and key exports — to Amplitude's analytics servers.

InsTF sends the signed-in user's Google email address and Instagram profile statistics to Mixpanel on account sign-in and follower-tracking task execution.

Keeper Password Manager stores, autofills, and manages credentials across all websites and supports enterprise SSO authentication.

MP3 Downloader scans every webpage for audio file links and lets users download them directly from the popup.

MapQuest Directions transmits each search query in real time to its servers and injects server-controlled HTML into every new tab page.

Netflix Skipper collects Netflix account details, viewing history, and profile data and transmits them to remote servers on a 30-minute cycle.

OKIOCAM Live sets uploaded Google Drive files to public 'anyone with link' sharing without user confirmation.

OWASP Penetration Testing Kit accepts page bridge messages that send saved DAST scan results to the configured PTK portal.

Poshmark Bot Sharer by Flyp transmits Poshmark user IDs and API request URLs to Sentry's error-tracking servers.

Price Tracker 2.0 collects product data from 15+ e-commerce sites and transmits it, along with user agent and timezone, to api.indiadesire.com.