Medium risk browser extensions

ClearTok sends your TikTok username and repost-removal activity to its own servers via a session-based tracking system.

EXIF Viewer Classic lets webpages trigger cross-origin image EXIF reads and displays the parsed metadata in the page.

Pomodoro overrides the browser's default search engine to pomodorosearch.com, routing all omnibox queries through a third-party domain with a per-install tracking ID.

Popup Blocker Max sends a unique per-user token and Google search counts to its server hourly and downloads unverified blocking rules from that server.

SAFEQ Cloud ships a Playwright testing backdoor in production that any Chrome extension can use to disable authentication or spoof identity.

CFCA CryptoKit.CIB Extension forwards caller-supplied native host names without validation, allowing any authorized origin to connect to arbitrary native messaging hosts.

CJDropshipping stores your raw account password in Chrome sync when remember password is selected.

CocoShot lets any website request and receive your camera and microphone device list through its permissions page.

Devolutions Workspace reads form fields on every page to autofill saved logins, and ships hardcoded credentials for its telemetry server.

EXIF Viewer Pro sends Flickr photo IDs to api.flickr.com over HTTP when you request EXIF data for Flickr images.

Free VPN - Super routes all your browser traffic through operator-supplied proxy servers configured from the vendor's remote API.

Free Vimeo Downloader sends a persistent UUID and usage events to Alibaba Cloud logging infrastructure on install and download actions.

LockSelf Professional Password Manager intercepts outgoing request bodies on every website to detect and capture username and password pairs.

MAL-Sync fetches remote configuration from chibi.malsync.moe to determine which anime sites receive dynamically registered content scripts.

Paint Tool for Chrome saves your drawings and text into each website's localStorage when you use its overlay.

Record Google Meet sends your Google account email and IP address to app.easymeetrecord.com for subscription and geo-based paywall checks.

Screenshot YouTube Video sends the current page URL and a persistent browser ID to api.videodlservice.com daily.

SimpRead can import a user-supplied 'third-party rule source' and runs expressions from those rules against the pages you read.

TON Wallet injects a wallet provider into every page that can return the logged-in TON address and balance.

Titans Quick View sends Amazon search cookies and a browser fingerprint to Self Publishing Titans for BSR results.

dataslayer forwards tag-management data from every inspected frame to the frame's parent page.

The extension downloads binaries from third-party GitHub repos without integrity verification and installs them via native messaging.

Amazon Order History Reporter transmits an RSA-encrypted user email and order metadata to the developer's server on each order history scrape.

Blueticks keeps a persistent connection to its MQTT broker and runs server-issued commands that read your WhatsApp contacts, chats, and messages.