Medium risk browser extensions

RuDostup fetches a remote proxy script from ytprx.ru and routes all of the user's browser traffic through a server-controlled proxy.

Shopify Theme Detector sends periodic telemetry to Google Analytics and probes every website the user visits for Shopify store metadata.

SmartOn ID Pass Extension encrypts native messaging traffic with a hardcoded AES-256 key, exposing credentials to any local process.

Snapchat Camera for Chrome reports per-site usage events and UI interactions to Snapchat's servers on every page visited.

Supademo records full DOM snapshots of pages you capture and sends debug logs with the active tab URL and account details to a third-party logger.

Tipli scrapes selected page text and sends it with the visited URL to www.tipli.cz.

Trim IMDB Rating sends your streaming page URLs, browsing metadata, and Netflix content details to its own servers and Google Analytics.

Universal Copy sends the hostnames of sites you visit, plus your IP, country and a persistent ID, to its Aliyun logging server.

VPN Japan - Planet VPN lite Proxy decrypts proxy credentials using a hardcoded key and can silently disable competing extensions.

Video Hunter Downloader collects your IP address and geolocation profile at startup and sends browsing activity to Google Analytics on every download and popup interaction.

Video to MP3 sends a built-in API token with format and download requests to yt-gateway.vercel.app.

Vimeo Downloader collects your IP, location, OS and a persistent device ID and sends them with usage events to an Aliyun log server.

Voice Out reads the page text or selection you ask it to speak and, on the default free voice, sends it to Google Translate's internal RPC.

Wanderlustar sets itself as your default search engine and routes every search through wanderlustar.com with a fixed affiliate tag.

Weatherly sends the user's IP address to ip-api.com over plain HTTP on install and every 25 minutes to resolve location for weather lookups.

Widilo Cashback embeds a third-party coupon SDK that tracks users with a persistent UUID and sends browsing events to smartshopping.ai.

Windsurf Plugin transmits full editor text, file paths, and browsing context to server.codeium.com on each keypress in web-based IDEs.

Xiaohongshu for Desktop sends each post's ID and Xiaohongshu access token to a third-party server (api.old-panda.com) to fetch media.

uTab routes every new-tab search through search.utab.io with a persistent per-user id before redirecting to Bing.

FastProxy - Россия transmits hashed browsing history to its servers and applies remotely-fetched proxy and redirect rules to user navigation.

360 Internet Protection forwards every URL visited, page title, and HTTP response headers to a local native application on each navigation.

Alternate Player for Twitch.tv sends Twitch stream tokens, GPU fingerprint, and session logs to a third-party server over plain HTTP.

AliExpress Coupon Finder opens a hidden tab to the developer's AliExpress affiliate link, attributing your purchase commission to them.

Anime Cursor fetches remote cursor URLs from api.gameograf.com on every popup open and injects them unsanitized into CSS on all web pages.

ChemDraw Web Clipboard bridges clipboard requests from any webpage to a local native messaging host on the user's machine.

Coursology sends selected text and tab screenshots to its AI API and stores user-uploaded files publicly on Vercel Blob storage.

CrapApi Http Test syncs your saved API requests, including headers and credentials, to its backend over unencrypted HTTP.

DownloadAs PNG JPG sends a persistent device UUID to Google Analytics every hour via a background heartbeat.

Dupe.com sends the URL and product metadata from every HTTPS page you visit to Google Analytics.

FadBlock Origin fetches its ad-detection rules from a remote GitHub Pages endpoint on install and update.

Get Maps & Directions sets getdirectionsmaps.com as the default search provider and sends address-bar searches there.

Shows how other news outlets cover the article you are reading.

Group Contact Extractor for WA reads the user's WhatsApp phone number and sends it to an Alibaba Cloud logging service.

IP Unblock VPN routes all browser traffic through a plain HTTP proxy with no encryption of its own.

InsTF sends the signed-in user's Google email address and Instagram profile statistics to Mixpanel on account sign-in and follower-tracking task execution.

Locker sends every URL visited, the domain of each site, and product page details to its vendor servers across all websites.

Manga Translator sends a device fingerprint and base64-encoded image data to ichigoreader.com with every translation request.