Medium risk browser extensions

Monosearch reads Amazon product and seller data from pages you view and forwards it to the vendor's mnsearch.com and mnrate.com backends.

OceanHero reads signed-in Google accounts and top-visited sites, and forwards your user ID to an ad network on every new tab.

OptimAI Lite Node collects device fingerprints and reports uptime to api.optimai.network every 10–15 minutes in exchange for passive-income rewards.

Perceptron Network reads Twitter OAuth2 session credentials from storage and sends them, along with full page DOM content, to its backend servers.

Pitch Changer sends session usage data including the origin of visited tabs to its own servers when server-side telemetry is enabled.

Plug transmits financial transaction details and a persistent user ID to Google Analytics, and exposes multiple third-party API keys in a web-accessible script any page can read.

QuickForm Record Mode stores typed form values, including password inputs, in extension storage.

RatePunk records every page's URL and sends hotel searches and prices to its servers, which can also direct it to fetch arbitrary URLs.

RuDostup fetches a remote proxy script from ytprx.ru and routes all of the user's browser traffic through a server-controlled proxy.

Shopify Theme Detector sends periodic telemetry to Google Analytics and probes every website the user visits for Shopify store metadata.

Snapchat Camera for Chrome reports per-site usage events and UI interactions to Snapchat's servers on every page visited.

YouTube Subtitle Downloader generates a persistent browser fingerprint and sends video IDs and user actions to the developer's server.

Supademo records full DOM snapshots of pages you capture and sends debug logs with the active tab URL and account details to a third-party logger.

Tipli scrapes selected page text and sends it with the visited URL to www.tipli.cz.

Traffic Lite exposes JWT auth tokens in browser-history URLs and accepts storage-wipe commands from any Netlify subdomain.

Trim IMDB Rating sends your streaming page URLs, browsing metadata, and Netflix content details to its own servers and Google Analytics.

Universal Copy sends the hostnames of sites you visit, plus your IP, country and a persistent ID, to its Aliyun logging server.

VPN Japan - Planet VPN lite Proxy decrypts proxy credentials using a hardcoded key and can silently disable competing extensions.

Video Hunter Downloader collects your IP address and geolocation profile at startup and sends browsing activity to Google Analytics on every download and popup interaction.

Vimeo Downloader collects your IP, location, OS and a persistent device ID and sends them with usage events to an Aliyun log server.

Voice Out reads the page text or selection you ask it to speak and, on the default free voice, sends it to Google Translate's internal RPC.

Wanderlustar sets itself as your default search engine and routes every search through wanderlustar.com with a fixed affiliate tag.

Weatherly sends the user's IP address to ip-api.com over plain HTTP on install and every 25 minutes to resolve location for weather lookups.

Web Maker syncs user code to Firebase and a multiplayer backend, and sends behavioral telemetry to a Google Cloud Run endpoint.

Widilo Cashback embeds a third-party coupon SDK that tracks users with a persistent UUID and sends browsing events to smartshopping.ai.

Windsurf Plugin transmits full editor text, file paths, and browsing context to server.codeium.com on each keypress in web-based IDEs.

Xiaohongshu for Desktop sends each post's ID and Xiaohongshu access token to a third-party server (api.old-panda.com) to fetch media.

iTour Video Translation captures audio from the current tab, screen, or microphone and streams it to Alibaba Cloud and Microsoft speech services for transcription.

uTab routes every new-tab search through search.utab.io with a persistent per-user id before redirecting to Bing.

FastProxy - Россия transmits hashed browsing history to its servers and applies remotely-fetched proxy and redirect rules to user navigation.

360 Internet Protection forwards every URL visited, page title, and HTTP response headers to a local native application on each navigation.

Alternate Player for Twitch.tv sends Twitch stream tokens, GPU fingerprint, and session logs to a third-party server over plain HTTP.

Web of Trust sends every URL you visit, Google Search results, and ad intelligence to secure.mywot.com on each page navigation.

AliExpress Coupon Finder opens a hidden tab to the developer's AliExpress affiliate link, attributing your purchase commission to them.

SellerApp's keyword tool silently scrapes your Amazon Seller Central Brand Analytics data and uploads it to SellerApp's servers.

Anime Cursor fetches remote cursor URLs from api.gameograf.com on every popup open and injects them unsanitized into CSS on all web pages.

ChemDraw Web Clipboard bridges clipboard requests from any webpage to a local native messaging host on the user's machine.

Coursology sends selected text and tab screenshots to its AI API and stores user-uploaded files publicly on Vercel Blob storage.

CrapApi Http Test syncs your saved API requests, including headers and credentials, to its backend over unencrypted HTTP.

Document Translator uploads documents you select in its popup to ai.imgkits.com cloud storage.

DownloadAs PNG JPG sends a persistent device UUID to Google Analytics every hour via a background heartbeat.

Dupe.com sends the URL and product metadata from every HTTPS page you visit to Google Analytics.

FadBlock Origin fetches its ad-detection rules from a remote GitHub Pages endpoint on install and update.

Get Maps & Directions sets getdirectionsmaps.com as the default search provider and sends address-bar searches there.

Google Apps Script GitHub Assistant ships hardcoded Bitbucket OAuth2 credentials that any party can extract from the extension bundle.