Medium risk browser extensions

Shows how other news outlets cover the article you are reading.

Group Contact Extractor for WA reads the user's WhatsApp phone number and sends it to an Alibaba Cloud logging service.

IP Unblock VPN routes all browser traffic through a plain HTTP proxy with no encryption of its own.

InsTF sends the signed-in user's Google email address and Instagram profile statistics to Mixpanel on account sign-in and follower-tracking task execution.

Locker sends every URL visited, the domain of each site, and product page details to its vendor servers across all websites.

Manga Translator sends a device fingerprint and base64-encoded image data to ichigoreader.com with every translation request.

Minea reads Facebook profile data (ID, name, city, birthday, gender) while browsing the Ads Library and sends it to data.minea.com.

My Focal Find sets itself as the default search engine and tags every search you type with a persistent per-install ID.

Open in Foxit™ Reader passes web-origin PDF URLs to a native shell command without sanitization when a custom Foxit path is configured.

PandaTab replaces your new tab with a full-screen iframe of tab.leisurelypanda.com and grants that remote page clipboard read access.

Promo Coders sends visited site domains and Google result domains to getutintsofthe.org for coupon lookups.

RoGold Ultimate transmits Roblox gameplay data to rogold.live every minute and loads remote CSS without integrity verification.

Scan WP sends the active tab URL to scanwp.net and renders the raw HTML response without sanitization.

SnapAny exposes unguarded postMessage bridges on all pages, letting any site open arbitrary tabs or inject OAuth credentials.

Text to Speech Google Docs sends page hostname and a snippet of the text you read aloud to Amplitude on every TTS session.

Titans Pro sends the full Amazon and Etsy page cookie string to go.selfpublishingtitans.com with keyword lookups.

Toby Mini sends open tab URLs and saved bookmark data to its servers when AI features are used.

The extension decrypts proxy credentials with a hardcoded AES key and can disable other installed browser extensions.

Snipo transmits a persistent user UUID and IP address to Mixpanel on every page load across all websites.

The extension sends Twitch browsing activity and a persistent user ID to both the operator's backend and Yandex Metrica on every channel visit.

Shinigami Eyes collects surrounding post DOM from social media pages and transmits it to shini-api.xyz when a user labels an account.

ZenMate Free VPN sends the user's real IP address and location to a third-party geolocation service on install.

1of10.com - Optimization Tool For Youtube assigns a persistent device ID and transmits it with browsing analytics to 1of10.com servers.

The extension lets any website use its content script as a cross-origin JSON POST proxy and disables CSP on pages.

AIPRM for Claude intercepts outgoing Claude conversation requests and transmits the user's account UUID to api.aiprm.com on every visit.

AdBlock Detector Bypass by CPE lets any webpage save hidden-element rules that later hide matching content on chosen sites.

Add to Microsoft To Do stores Microsoft OAuth tokens in sync storage encrypted with a hardcoded AES key bundled in the extension source.

AdsMeta reads your Facebook ad-account access token from facebook.com and shares it with its own adsmeta.io dashboard.

Media Interceptor exposes an extension ID-derived marker in the page DOM on visited sites.

AutoDS - Dropshipping Helper intercepts XHR traffic and request headers on supplier sites and sends AliExpress product URLs to a third-party server for affiliate link rewriting.

Axhub accepts page-supplied URLs to fetch and execute remote JavaScript in any open tab via chrome.scripting.executeScript.

Batch Upload Tool sends page URLs, device identifiers, and IP addresses to events.sellfox.com on every product scrape action.

BeeLine Reader sends the full URL of each active page to Google Analytics via a tracking pixel for free and trial users.

Best Cursors exposes a stored user identifier and cursor collection to any website via unguarded message handlers.

Bright Tab routes every new-tab search query through its own server with a persistent user ID and a server-assigned secret token.

CCH® Browser Search transmits search queries and a user identifier to cchconnect.cch.com on every Google, Bing, and Google Scholar search.

CMS Detect sends the active tab's URL to cmsdetect.com over plaintext HTTP each time the popup is opened.