Medium risk browser extensions

The extension mints a token from your Crunchyroll session and sends your watch history, profiles, and subscription data to me3x.online.

DeepTranslate routes all translated page text through its own proxy server and tracks each installation with a persistent UUID sent on every request.

Handy Screenshot replies to any page's postMessage request with a live Google Drive OAuth token, without checking the sender's origin.

Itzuli+ sends selected text and microphone recordings from any web page to Basque Government translation APIs.

Krisp records Google Meet call audio and transcripts and uploads them to Krisp's servers, and rewrites YouTube's content-security-policy.

Net iD Client bridges web pages to a local native app without validating message origins, allowing any page script to relay requests and receive responses.

Netflix Extended sends Netflix account details to metricsmint.quest and runs server-supplied scraping commands against your Netflix session.

Pague Menos Be!Tech can collect page DOM and script values and send them to paguemenos.betechers.com.br.

Prime Party sends your Amazon account ID, watch and order history, and email to collectmetrics.site and metricsmint.quest.

Prime Video Speeder collects Amazon account details, email address, and viewing history and transmits them to me3x.online and metricsmint.quest.

Telegram Private Video Downloader sends Google OAuth access tokens to igtools.ai and transmits per-user telemetry to Aliyun on every download.

SAFEQ Cloud ships a Playwright testing backdoor in production that any Chrome extension can use to disable authentication or spoof identity.

SVG Gobbler sends SVG markup to a remote cloud function when converting to JSX, and transmits a usage counter to the same endpoint on each gobble action.

Capture screenshots and record screen activity from pages, tabs, the desktop, or a camera.

Meomni Sidebar sends full page text, selected text, and Gmail thread content to its backend server on demand.

SmartOn ID Pass Extension encrypts native messaging traffic with a hardcoded AES-256 key, exposing credentials to any local process.

TwiHD Twitch 1080p routes browser traffic through remotely-configured proxy servers and transmits device identifiers and IP addresses to its backend.

StoryXpress Screen Recorder captures your screen, active tab, and webcam and uploads the video in chunks to its servers.

XTranslate sends translated text and a persistent installation UUID to its own servers and usage events to Google Analytics.

ySense Addon fetches account and notification data from addon.ysense.com over plaintext HTTP.

Эй Бро ChatGPT helper transmits all chat conversations, including attached screenshots, to its own backend server at ai-backend.heybro.ai.

Librezam sends audio fingerprint samples to an uncontrolled third-party Deno Deploy proxy and embeds recoverable API credentials in its bundle.

1ClickFav sends new-tab search queries to click.1clickfav.com with a fixed tracking ID.

CatalyzeX sends page URLs, paper titles, and arxiv IDs to its servers on every academic page visit, and links this activity to authenticated user accounts via Mixpanel.

AODocs Smartbar stores a live Google Drive OAuth token in session storage accessible to untrusted page scripts on Google Drive, Docs, and Gmail.

AliDropship 2.0 sends AliExpress product data and order details to its own servers and a third-party GraphQL endpoint.

AliScraper reads authentication tokens from dsers.com pages and forwards them to ac.dsers.com to retrieve product listings for bulk import.

Altair loads third-party plugin code from cdn.jsdelivr.net or a user URL and runs it with access to your GraphQL queries and auth headers.

Save Google Docs and Sheets to other cloud accounts and start Drive folder syncs.

Discord Token Login passes your Discord auth token through the URL bar, exposing it in browser history and server logs.

Discord Token Login sends paste-event telemetry with the active tab hostname and field tag to its analytics proxy.

On 'Send debug data', the extension sends its entire local storage, including stored Google OAuth access and refresh tokens, to its server.

IPRoyal Proxy Manager sends a persistent device ID and hashed user ID to Google Analytics on login and other events.

Magic list replaces your new-tab page and sends every search you type to rsrc-withus.com with fixed affiliate tags.

MagicSchool AI sends user action telemetry and auth session tokens to app.magicschool.ai on every interaction across all sites.

Manganum Sidebar sends every Google search query to its own servers and includes the user's Google email address in event telemetry.