Medium risk browser extensions

Doodle games collection removes Content-Security-Policy and X-Frame-Options headers across all sites.

Download Station sends NAS login passwords over HTTP when users keep its default http://diskstation:5000 settings.

ESUIT | Un Seen for Facebook removes Content-Security-Policy headers on Facebook and Messenger pages.

Email Scraper for Ins uploads extracted Instagram lead records to remote-configured Echobot endpoints.

FLG accepts login tokens from page events and uses them for FLG Platform API requests.

FaniMani.pl Donation Reminder sends visited page URLs with a persistent user identifier to FaniMani stats and Google Analytics.

Fast Wallet sends biometric auth keys and a persistent device identifier to api.suiet.app, a third-party server, during biometric setup.

Force Paster sends paste activity, active hostnames, and field tags to a Cloud Functions analytics proxy.

Free AI ReCaptcha Solver by Raptor stores solved reCAPTCHA images and labels and uploads them to captcharaptor.com.

Greenhub Free VPN can install a PAC proxy that routes ad and tracker domains through Greenhub-controlled proxies.

HBO Max HQ collects viewing history, account PII, and subscription data and transmits them to third-party servers under remote command.

HBOmax Skipper sends account-linked Max profiles, viewing history, and live-event telemetry to external servers.

Homer sends real-estate listing pages, search URLs, listing IDs, and page-view analytics to its APIs.

Hustle sends each keystroke typed into its new-tab search box to hustletab.io for autocomplete suggestions.

IGFollowExporter sends Instagram profile links and user IDs to Cloudflare Worker endpoints during exports.

Inline Lingo Translator removes browser security headers from Google Translate subframe requests and responses.

Jabra Device Connector exposes a native messaging bridge to the Jabra SDK app that any web page can invoke without origin restrictions.

Kimi Copilot sends the URL of each page summarized by the user to PostHog's analytics service alongside a persistent anonymous ID.

Klarway continuously captures screen video, webcam footage, and audio during exams and transmits them to its backend, while broadcasting session credentials to all page scripts.

Lazy Scholar sends scholarly article details, page URLs, tab metadata, and a stored user ID to an AWS API.

Leetify for Codeforces accepts a login session token from any page loaded on localhost:3000, not just its own site.

Linguix sends text fragments surrounding grammar corrections to Amplitude analytics on any website.

Madomi - Manga Translator sends page text, image URLs, and image data to borang.skrin.xyz for translation and summarization.

Magnifying Glass for Google Chrome places a screenshot of the current tab into the page DOM after you click it.

Majestic Mountain Views sets an unbranded third-party site as your browser's default search engine and routes every search through it.

Messenger Central sends new-tab search queries to srchms.com with a fixed affiliate identifier.

Multiversity LockDown Browser transmits student name, username, and exam identifiers to a proctoring server and disables all other extensions during exam sessions.

Navigate Rewards scrapes order history from Amazon, eBay, Etsy, and other shopping sites, and Reddit content, then forwards it to prod.socialsurfer.xyz.

Net-Pocket reads product details from shopping pages using remote selectors and sends them to api.net-pocket.com.

Netflix 同時字幕で英語学習 stores a Google Sign-In ID token in Netflix page localStorage.

Omni renders tab, bookmark, and history details into every page's DOM when its command menu is used.

OneScholar writes saved settings, including API keys, into page-accessible storage and form fields during backup/export.

Online Dictionary Helper fetches selected dictionary scripts from GitHub or custom URLs and runs them in its sandbox.

Online Weather Forecast sends typed new-tab search queries to transitschedules.net before search submission.

Open in IE downloads a native client binary from GitHub without checksum or signature verification.

PDF Manuals routes address-bar searches to pdfmanuals.net and maintains a five-year UID cookie for that site.

PDF Translator ships recoverable Alibaba OSS access key material in its popup source.

Page Sidebar strips X-Frame-Options and CSP headers globally and grants camera, microphone, geolocation, and clipboard to any framed page.

Paint Tool by Painty sends top-site hostnames for favicon lookup and typed search text for autocomplete.

Ping Network VPN computes a browser/device fingerprint in the popup and sends its components to pingvpn.xyz.

Poshmark | PosherVA can send Poshmark session cookies to PosherVA-controlled Firebase storage on remote command.

Pure Planet Earth sets itself as your default search engine and stamps every search you make with a persistent tracking ID.

Quick Spotify Search sends address-bar searches to chromecrxstore.com while labeling the provider Google.

RYS exposes the MD5 hash of its settings-lock password to YouTube pages as a DOM attribute.

Recipe Search tags default-search queries with a persistent extension GUID and campaign type before redirecting them.

Rocket Sender automates WhatsApp messaging and decides where to activate from a class-name list fetched from its remote config server.

Screen Dimmer loads a hidden onlineapp.pro paywall iframe on every page you visit.

Search All routes Amazon and eBay searches through affiliate links and injects a promotional iframe into Google results.

Ship Xanh accepts localhost messages that can replace its stored account token.

SignUp sends streaming page URLs and titles with a persistent analytics ID to its backend and Google Analytics.

Simple Video Download Helper sends the current page URL and user API key to a third-party server when the popup is opened.

Smartschool++ ships plaintext third-party API keys and fetches server-supplied URLs without validation.

SpoilerProtection sends settings backups and backup passwords over plaintext HTTP.