Medium risk browser extensions

The extension mints a token from your Crunchyroll session and sends your watch history, profiles, and subscription data to me3x.online.

DeepTranslate routes all translated page text through its own proxy server and tracks each installation with a persistent UUID sent on every request.

Handy Screenshot replies to any page's postMessage request with a live Google Drive OAuth token, without checking the sender's origin.

Krisp records Google Meet call audio and transcripts and uploads them to Krisp's servers, and rewrites YouTube's content-security-policy.

Net iD Client bridges web pages to a local native app without validating message origins, allowing any page script to relay requests and receive responses.

Netflix Extended transmits a persistent user ID to gathering.solutions and lets svodextensions.com request broad browser permissions.

Pague Menos Be!Tech can collect page DOM and script values and send them to paguemenos.betechers.com.br.

Telegram Private Video Downloader sends Google OAuth access tokens to igtools.ai and transmits per-user telemetry to Aliyun on every download.

SVG Gobbler sends SVG markup to a remote cloud function when converting to JSX, and transmits a usage counter to the same endpoint on each gobble action.

Screen Ruler exposes its stable extension ID in page-visible DOM markers when the ruler is activated.

Traffic Lite exposes JWT auth tokens in browser-history URLs and accepts storage-wipe commands from any Netlify subdomain.

TwiHD Twitch 1080p routes browser traffic through remotely-configured proxy servers and transmits device identifiers and IP addresses to its backend.

StoryXpress Screen Recorder captures your screen, active tab, and webcam and uploads the video in chunks to its servers.

XTranslate sends translated text and a persistent installation UUID to its own servers and usage events to Google Analytics.

ySense Addon fetches account and notification data from addon.ysense.com over plaintext HTTP.

Эй Бро ChatGPT helper transmits all chat conversations, including attached screenshots, to its own backend server at ai-backend.heybro.ai.

Librezam sends audio fingerprint samples to an uncontrolled third-party Deno Deploy proxy and embeds recoverable API credentials in its bundle.

CatalyzeX sends page URLs, paper titles, and arxiv IDs to its servers on every academic page visit, and links this activity to authenticated user accounts via Mixpanel.

AODocs Smartbar stores a live Google Drive OAuth token in session storage accessible to untrusted page scripts on Google Drive, Docs, and Gmail.

AliDropship 2.0 sends AliExpress product data and order details to its own servers and a third-party GraphQL endpoint.

AliScraper reads authentication tokens from dsers.com pages and forwards them to ac.dsers.com to retrieve product listings for bulk import.

Altair loads third-party plugin code from cdn.jsdelivr.net or a user URL and runs it with access to your GraphQL queries and auth headers.

Discord Token Login passes your Discord auth token through the URL bar, exposing it in browser history and server logs.

Discord Token Login sends paste-event telemetry with the active tab hostname and field tag to its analytics proxy.

On 'Send debug data', the extension sends its entire local storage, including stored Google OAuth access and refresh tokens, to its server.

IPRoyal Proxy Manager sends a persistent device ID and hashed user ID to Google Analytics on login and other events.

Itzuli+ sends selected text and microphone recordings from any web page to Basque Government translation APIs.

Magic list replaces your new-tab page and sends every search you type to rsrc-withus.com with fixed affiliate tags.

MagicSchool AI sends user action telemetry and auth session tokens to app.magicschool.ai on every interaction across all sites.

Manganum Sidebar sends every Google search query to its own servers and includes the user's Google email address in event telemetry.

OceanHero reads signed-in Google accounts and top-visited sites, and forwards your user ID to an ad network on every new tab.

OptimAI Lite Node collects device fingerprints and reports uptime to api.optimai.network every 10–15 minutes in exchange for passive-income rewards.

Perceptron Network reads Twitter OAuth2 session credentials from storage and sends them, along with full page DOM content, to its backend servers.

Pitch Changer sends session usage data including the origin of visited tabs to its own servers when server-side telemetry is enabled.

Plug transmits financial transaction details and a persistent user ID to Google Analytics, and exposes multiple third-party API keys in a web-accessible script any page can read.

Prime Video Speeder collects Amazon account details, email address, and viewing history and transmits them to me3x.online and metricsmint.quest.

QuickForm Record Mode stores typed form values, including password inputs, in extension storage.

RatePunk records every page's URL and sends hotel searches and prices to its servers, which can also direct it to fetch arbitrary URLs.