Medium risk browser extensions

Sticky Note Board Extension redirects new-tab search queries to search.notesticky-extension.com with an affiliate tracking ID.

TOTP Authenticator reads Firebase account data and decrypts it with a key derived only from the user's email address.

Tab Suspender exposes open-tab titles, URLs, and favicon URLs to pages when its tab manager is opened.

Talis Reading Lists Bookmarking sends the URL of any site you click its toolbar on to Google Analytics with a persistent install ID.

Text Spotlight sends entered URLs to edurls.org to create shortened links or QR codes.

Tool 42 loads the remotejs.com agent into its extension page when opened with a debug hash.

Topview AI extension lets any web page seed its social publishing state and open supported social platform tabs.

Traffic Ad Bar Surf Bar removes frame protections and rewrites subframe request headers in its Traffic Ad Bar tabs.

Transfer Dropbox to Google Drive uses a hardcoded AES-128-ECB key to decrypt all API responses from its backend, exposing user data to any party with access to the extension source.

Triton Tab sends IP-derived latitude and longitude to its weather API over cleartext HTTP.

UrbanTabs sends searches typed on its new-tab page to bseeksrc.com.

VK Music Player embeds a Last.fm API secret and removes response security headers for pages it loads.

VideoTogether lets any webpage use its bridge to read whitelisted service responses and write records into extension storage.

View Manuals sends every keystroke typed in its search bar to viewmanuals.com in real time.

Vivid Sparkles sends new-tab search queries with persistent install identifiers to search.vividsparkles.net.

WA Toolbox by Elbruz Technologies sends deleted WhatsApp message bodies and call records to its Firebase project.

WAPPMASTER Contacts Extractor sends the WhatsApp account number it reads from web.whatsapp.com storage to Aptabase.

WADeck reads your WhatsApp phone number and sends URLs from private conversations to third-party link-preview servers.

Web Color Inverter Tool sends each completed tab navigation's hostname with a persistent UUID to tracker01.paradisesv.net.

Wingman Clock sends new-tab search queries to goog.Wingmanclock.com with an affiliate tracking ID.

Worldwide Clock Extension sends new-tab search queries to search.worldwideclockextension.com with a fixed traffic ID.

Youtube Summary With AI sends page URLs and video metadata to PostHog analytics when users trigger AI features.

Youtube Video Skip Ad Trigger sends each YouTube URL you visit to Google Analytics, tied to a persistent per-user UUID.

eckoWALLET sends matched shopping-page URLs with wallet and user identifiers to Bring Web3.

simpleGestures lets web pages mimic mouse gestures that trigger tab actions through the extension.

stopRU sends visited YouTube page URLs and detected video/channel details to Mixpanel analytics.

SellerSprite collects Amazon product listings, seller details, keyword rankings, and review data from users' sessions and transmits them to its own servers.

Video Download injects a hidden iframe to div.show on every page, plus a time-delayed variant that activates 8+ hours after install.

Easy Video Downloader fetches a native client binary from GitHub and optionally passes tab cookies to a local native messaging process.

AutoSBC sends FUT player inventory snapshots and market price data to its own servers, with upload behavior controlled by a remote config.

Copyfish routes images through a public CORS proxy and sends tab screenshots to a third-party OCR service via a hardcoded shared API key.

cat-catch intercepts all browser network requests to detect and capture media URLs (video, audio, M3U8, and MPD streams).

Media Converter and Muxer downloads FFmpeg from GitHub without verifying file integrity before installing it to the user's home directory.

AudD Music Recognition sends tab URL, page title, and a persistent device ID to api.audd.io on every song recognition request.

Speed Dial fetches a remote affiliate code on install, appends it to Yahoo searches, and screenshots bookmarked pages in hidden windows.

XDM Browser Monitor collects cookies and request headers for intercepted downloads and sends them to the local XDM app via plaintext HTTP.

Bonjourr sends shortcut link origins, sync URLs, and custom background URLs to its own proxy service when direct requests fail.

VPN Free Unlimited - VPNLY sends the user's real IP to a third-party server on every startup and bundles hardcoded proxy credentials.

Recipio routes all search queries through Yahoo affiliate search with hardcoded partner tracking codes, without disclosing this to users.

1688 Search by Image & Image Downloader reads 1688 and Taobao login cookies for its shopping search features.

1ClickFav sends new-tab search queries to click.1clickfav.com with a fixed tracking ID.

2! Authenticator stores TOTP account secrets as reversible base64 JSON unless the user enables a password.

2FA Authenticator Guard encrypts no-login TOTP secrets with a hardcoded password stored in the extension code.

3D Street View sets 3dstreetview.com as the browser's default search provider and sends address-bar searches there.

AMALYZE sends hashed Chrome profile email, profile ID, and an extension UUID to falcon.amalyze.com during heartbeats.

API Tester - REST Client Testing Tool acts as a remote-controlled HTTP proxy and sends fetched response data to api.asotools.io.

Adblock for YouTube Block Ads Skip Video Sponsored rewrites matching merchant tabs to affiliate links from Google Sheets.

Advanced Notepad backs up saved notes to JSONBin with hardcoded keys that can read backups by ID.

AiPrice(AliPrice) Search by Image for Amazon tracks matched browsing URLs and sends them to api.aliprice.com.

AiPrice(AliPrice) sends page URLs, titles, and referrers from all HTTP and HTTPS pages to analytics endpoints.

Ali Invoice can disable selected installed extensions based on a remote compatibility list.

AliExpert Shopping Assistant opens remote-configured affiliate redirects in hidden tabs on AliExpress product pages.

AliCompare opens a hidden AliExpress affiliate redirect tab when you reach checkout.

AliSave sends merchant page URLs to alisave.info and can apply server-supplied redirects.

Aliexpress Dropshipping sends product and order data to the store API URL configured by the user.

Always Secured powered by Yahoo redirects Google and Bing search-result visits to alwayssecuredsearch.com with the query preserved.

Amazon Quick View by EarData sends Amazon Seller Central and retail page URLs and page HTML to EarData's API.

Amazon Search Pro routes address-bar, popup, omnibox, and selected-text searches through chromecrxstore.com.