Medium risk browser extensions

ProTab | Arbfonts injects script into competitor Arabic font sites to strip all hyperlinks, disabling navigation on those pages.

ROSE Wallet stores a V0 migration backup of private keys in extension localStorage protected by a KDF 31x weaker than the current standard.

SEMRush Rank transmits the full URL of each visited tab to rank.trellian.com on every page load and tab switch.

Savings add-on sends merchant names and interaction events to Google Analytics using a persistent identifier, without prompting Chrome users for consent.

Serpstat Website SEO Checker records every URL visited and periodically uploads the full browsing history to plugin.serpstat.com.

ShopNow replaces the default search engine and injects a cookie-derived affiliate tracking parameter into navigations to alphashopnow.co.

Shorts scroller sends YouTube, U-NEXT, and Crunchyroll account/profile and viewing data to me3x.online.

Simple Allow Copy routes Chrome updates through agency.pictureknow.com and injects server-controlled affiliate links into shopping pages.

Slice New Tab fetches server-controlled redirect rules from api.addslice.com and applies them to browsing traffic when the '<all_urls>' permission is granted.

SmartSolve captures screenshots and selected text from any tab and transmits them to api.smartsolve.ai, while suppressing browser events to conceal itself from exam platforms.

Street View Maps renders remote HTML from its own server into the new tab page without sanitization and transmits every search keystroke to its server.

Text to Speech Google Docs sends page hostname and a snippet of the text you read aloud to Amplitude on every TTS session.

Tree Style Tab sends user interaction telemetry to Google Analytics, including IP-derived location and a persistent tracking UUID.

Trusted Browse overrides the default search engine and redirects Google and Bing searches to a Yahoo-affiliate proxy.

USC Schedule Helper saves notification email and phone entries in USC WebReg page storage.

Udemy Dual Subtitles sends tab URL, tab title, and a persistent user UUID to its own backend and to Amplitude on every subtitle translation request.

Undetectable AI sends selected page text to its detection, humanizing, paraphrasing, and citation endpoints when you use its tools.

Unfollower Tracker for IG receives server-controlled extraction patterns and can open arbitrary URLs on command from besocial.top.

VPN Satoshi collects a browser fingerprint on startup and transmits it to its backend, while storing credentials encrypted with a hardcoded key.

Video to MP3 sends a built-in API token with format and download requests to yt-gateway.vercel.app.

View Rendered Source sends the analyzed page URL, user-agent, and locale to Beam Analytics each time the extension is invoked.

Web Shield routes browser search queries and suggestions through dealsearcherplus.com domains.

Web Translator overrides the browser's default search engine and new tab page to route all searches through search.web-translater-tab.com.

Wildbox reads Wildberries' session and anti-bot cookies on wildberries.ru and attaches them to requests sent to wildbox.ru.

The extension intercepts AliExpress checkout responses and reads session cookies to automate order placement and shipping configuration.

YouTube Monetization & RPM Checker by TubeLab sends YouTube channel RPM and monetization details to TubeLab servers.

The extension sends Twitch browsing activity and a persistent user ID to both the operator's backend and Yandex Metrica on every channel visit.

The extension fetches remote config from GitHub daily and runs scripts in every open browser tab on a remotely controlled schedule.

The extension periodically fetches a PAC script from yiban.io and applies it as the system-wide Chrome proxy, routing all browser traffic through a remotely-controlled configuration.

SMART DATA sends buyer PII and customs codes to unipass.customs.go.kr via a hardcoded API key, and sends session data over plaintext HTTP.

Song Identifier captures a 5-second audio fingerprint from active tab media and sends it to ACRCloud, using hardcoded API credentials.

VPN add-on transmits a canvas and WebGL device fingerprint to api.uvpn.me on every sign-in, and sends account-linked telemetry to analytics.uvpn.me.

Lightshot sends screenshot image data to its upload server over unencrypted HTTP.

Quick Recipe Hub & Custom Web Search sets Yahoo as the default search engine with affiliate tracking parameters appended to every query.

Trending News & Search redirects user searches to Yahoo using hardcoded affiliate tracking codes with no disclosure to users.

2chRevival fetches a plaintext URL list from websvc2.jpn.org to drive archived-thread revival requests.

Aggilizador stores broker credentials and auto-submits them on insurer login pages.

Ali Invoice FREE reroutes AliExpress product and store clicks through alitems.link affiliate tracking.

AliBill sends AliExpress order details to api.alibill.net and mirrors product/store clicks to an affiliate endpoint.

All Doodle games removes Content-Security-Policy and X-Frame-Options headers across all URLs.

AutoBuy Flash Sales, Deals, and Coupons sends shopping-page URLs to its coupon service and rewrites Flipkart product clicks.

Avantpro AMZ contacts its Scrapo alerts backend with a bundled API key on Amazon pages.

BeLikeNative sends selected text from any website to its AI backend and transmits telemetry including visited domains to the same server.

Best Cursors exposes a stored user identifier and cursor collection to any website via unguarded message handlers.

Better Lyrics Shaders sends YouTube Music track metadata to artwork.boidu.dev for animated art.

BuxBack - Earn R$ has no confirmed reviewed findings in the scanner yet.

CFCA CertEnrollment.SRCB Extension bridges SRCB bank pages to locally installed native messaging hosts without validating the host name.

Captions for Live Presentations sends user IP address, geolocation, and speech transcripts to third-party servers.

Cats Fan sends new-tab search queries to cats.catsfanext.com with an affiliate tracking ID.

Change Timezone (Time Shift) accepts timezone-override commands from any page, with no check on who sent them.

ClassroomGo embeds a hardcoded YOURLS API signature in its bundle, allowing any party with source access to create short URLs on gtogo.to.

Classwork Zoom can upload Google Classroom and Drive API responses when server-controlled logging is enabled.

Claude Tuner sends snapshot submissions to its backend using a shared fallback API key.

Dark Theme - Custom New Tab sends new-tab search terms to find.wsrcnav.com with fixed tracking parameters.

Data Dive removes X-Frame-Options from subframe responses across all websites.