Medium risk browser extensions

Mendeley Web Importer sends analytics with your IP address and device fingerprint to New Relic, Adobe Analytics, and Mendeley.

User-Agent Switcher and Manager fetches its agent list from cdn.jsdelivr.net at an unpinned @latest reference with no integrity check.

CJDropshipping stores your raw account password in Chrome sync when remember password is selected.

Check US Visa Slots sends a screenshot and account details from usvisascheduling.com pages to app.checkvisaslots.com.

EXIF Viewer Classic lets webpages trigger cross-origin image EXIF reads and displays the parsed metadata in the page.

LockSelf Professional Password Manager intercepts outgoing request bodies on every website to detect and capture username and password pairs.

Pomodoro overrides the browser's default search engine to pomodorosearch.com, routing all omnibox queries through a third-party domain with a per-install tracking ID.

Popup Blocker Max sends a unique per-user token and Google search counts to its server hourly and downloads unverified blocking rules from that server.

Screenshot YouTube Video sends the current page URL and a persistent browser ID to api.videodlservice.com daily.

Blueticks keeps a persistent connection to its MQTT broker and runs server-issued commands that read your WhatsApp contacts, chats, and messages.

CFCA CryptoKit.CIB Extension forwards caller-supplied native host names without validation, allowing any authorized origin to connect to arbitrary native messaging hosts.

This extension clears browsing data such as history, cache, cookies, downloads, passwords, and saved form data.

CocoShot lets any website request and receive your camera and microphone device list through its permissions page.

EXIF Viewer Pro sends Flickr photo IDs to api.flickr.com over HTTP when you request EXIF data for Flickr images.

Free VPN - Super routes all your browser traffic through operator-supplied proxy servers configured from the vendor's remote API.

Free Vimeo Downloader sends a persistent UUID and usage events to Alibaba Cloud logging infrastructure on install and download actions.

MAL-Sync fetches remote configuration from chibi.malsync.moe to determine which anime sites receive dynamically registered content scripts.

Paint Tool for Chrome saves your drawings and text into each website's localStorage when you use its overlay.

Record Google Meet sends your Google account email and IP address to app.easymeetrecord.com for subscription and geo-based paywall checks.

Screen Ruler exposes its stable extension ID in page-visible DOM markers when the ruler is activated.

Titans Quick View sends Amazon search cookies and a browser fingerprint to Self Publishing Titans for BSR results.

Video to MP3 sends a built-in API token with format and download requests to yt-gateway.vercel.app.

dataslayer forwards tag-management data from every inspected frame to the frame's parent page.

The extension downloads binaries from third-party GitHub repos without integrity verification and installs them via native messaging.

Amazon Order History Reporter transmits an RSA-encrypted user email and order metadata to the developer's server on each order history scrape.

Browser-Surf replaces the new tab page with a search form that forwards every query to browser-surf.xyz with an affiliate tracking ID.