Medium risk browser extensions

Minea reads Facebook profile data (ID, name, city, birthday, gender) while browsing the Ads Library and sends it to data.minea.com.

Monosearch reads Amazon product and seller data from pages you view and forwards it to the vendor's mnsearch.com and mnrate.com backends.

OKIOCAM Live sets uploaded Google Drive files to public 'anyone with link' sharing without user confirmation.

OP_WALLET sends a persistent device ID and Bitcoin wallet address to its servers on every browser start.

Open in Foxit™ Reader passes web-origin PDF URLs to a native shell command without sanitization when a custom Foxit path is configured.

PandaTab replaces your new tab with a full-screen iframe of tab.leisurelypanda.com and grants that remote page clipboard read access.

RoGold Ultimate transmits Roblox gameplay data to rogold.live every minute and loads remote CSS without integrity verification.

Scan WP sends the active tab URL to scanwp.net and renders the raw HTML response without sanitization.

SnapAny exposes unguarded postMessage bridges on all pages, letting any site open arbitrary tabs or inject OAuth credentials.

TG DownloadHelper transmits the active tab URL, user email, and a persistent UUID to Alibaba Cloud on install, update, and each download action.

Text to Speech Google Docs sends page hostname and a snippet of the text you read aloud to Amplitude on every TTS session.

Toby Mini sends open tab URLs and saved bookmark data to its servers when AI features are used.

Urban AdBlocker sends URLs, page titles, referrers, and request metadata from visited pages to Urban VPN.

The extension decrypts proxy credentials with a hardcoded AES key and can disable other installed browser extensions.

Web Maker syncs user code to Firebase and a multiplayer backend, and sends behavioral telemetry to a Google Cloud Run endpoint.

Snipo transmits a persistent user UUID and IP address to Mixpanel on every page load across all websites.

YouTube Subtitle Downloader generates a persistent browser fingerprint and sends video IDs and user actions to the developer's server.

The extension sends Twitch browsing activity and a persistent user ID to both the operator's backend and Yandex Metrica on every channel visit.

iTour Video Translation captures audio from the current tab, screen, or microphone and streams it to Alibaba Cloud and Microsoft speech services for transcription.

Web of Trust sends every URL you visit, Google Search results, and ad intelligence to secure.mywot.com on each page navigation.

Shinigami Eyes collects surrounding post DOM from social media pages and transmits it to shini-api.xyz when a user labels an account.

ZenMate Free VPN sends the user's real IP address and location to a third-party geolocation service on install.

1of10.com - Optimization Tool For Youtube assigns a persistent device ID and transmits it with browsing analytics to 1of10.com servers.

The extension lets any website use its content script as a cross-origin JSON POST proxy and disables CSP on pages.

AIPRM for Claude intercepts outgoing Claude conversation requests and transmits the user's account UUID to api.aiprm.com on every visit.

Add to Microsoft To Do stores Microsoft OAuth tokens in sync storage encrypted with a hardcoded AES key bundled in the extension source.

AdsMeta reads your Facebook ad-account access token from facebook.com and shares it with its own adsmeta.io dashboard.

SellerApp's keyword tool silently scrapes your Amazon Seller Central Brand Analytics data and uploads it to SellerApp's servers.

AutoDS - Dropshipping Helper intercepts XHR traffic and request headers on supplier sites and sends AliExpress product URLs to a third-party server for affiliate link rewriting.

Axhub accepts page-supplied URLs to fetch and execute remote JavaScript in any open tab via chrome.scripting.executeScript.

Batch Upload Tool sends page URLs, device identifiers, and IP addresses to events.sellfox.com on every product scrape action.

BeeLine Reader sends the full URL of each active page to Google Analytics via a tracking pixel for free and trial users.

Best Cursors exposes a stored user identifier and cursor collection to any website via unguarded message handlers.

Bright Tab routes every new-tab search query through its own server with a persistent user ID and a server-assigned secret token.

CCH® Browser Search transmits search queries and a user identifier to cchconnect.cch.com on every Google, Bing, and Google Scholar search.

CMS Detect sends the active tab's URL to cmsdetect.com over plaintext HTTP each time the popup is opened.

Companion Window sends the full URL of pages you visit plus a persistent user ID to GiveFreely's analytics server when its review prompt fires.

Create Link executes user-defined JavaScript in the content script context on every page visited when a custom format filter is set.

Crunchyroll Speeder exchanges your Crunchyroll session cookies for an OAuth token and reads your account, history, and subscription data.

Dashlinks - New Tab replaces the browser's new tab page and sends every search query to search4it.net along with the extension ID and version.

Debrid-Link renders notification details into every HTTP/HTTPS page where page scripts can read them.