Browser extensions starting with C

Colorpick Eyedropper ships a hardcoded Google Safe Browsing API key in its bundle that any user can read.

Copyfish routes images through a public CORS proxy and sends tab screenshots to a third-party OCR service via a hardcoded shared API key.

cat-catch intercepts all browser network requests to detect and capture media URLs (video, audio, M3U8, and MPD streams).

Censor Tracker fetches its proxy server configuration from a remote GitHub URL and routes all browser traffic through that server.

AI Sidebar weakens frame protections and changes fetch headers for pages opened inside its side panel.

ClickUp BrainMax sends the user's real IP address, country, OS, and a device UUID to the Singular attribution SDK on install and on each login.

The extension lets any hebbank.com page connect to an arbitrary native messaging host on the user's OS without validation.

CFCA CertEnrollment.UD Extension bridges CFCA web pages to native messaging hosts without validating the caller-supplied host name.

CFCA CryptoKit.SDRCB Extension bridges sdebank.com pages to local native messaging hosts without validating the host name supplied by the caller.

CSS Scan fetches stylesheet URLs through its background page and writes the responses into a page-readable iframe.

Cache Killer clears the browser cache before pages load when the user enables it.

Provides a calendar clock as a browser extension.

Camera sends user-submitted webcam snapshots to mara.photos for photo editing.

Canned Replies posts saved canned replies from Chrome sync storage to my.cannedreplies.com during options-page migration.

CapMonster Cloud reads all cookies for the current site and attaches them to the captcha-solving request it sends to its own API.

Capios ships a disabled LinkedIn sharing branch with OAuth client secret and cookie values in web-accessible source.

Capital Koala sends the current merchant page URL to capitalkoala.com when you activate a cashback offer.

CaptchaSonic uploads your installed-extension inventory and stable browser fingerprint after API-key setup.

Car Tab sends the hostnames of frequently visited sites to Google's favicon service when the new tab opens.

Career.io Job Auto Apply lets any webpage set Career.io account tokens in the extension through an unchecked app.html message.

Cars Lightning Speed sends your leaderboard nickname and score over cleartext HTTP to a Disney highscores server.

Cashdo lets any website ask the extension to open a caller-chosen URL in a new browser tab.

Casper Wallet sends visited merchant URLs and the active wallet public key to api.bringweb3.io for its BringWeb3 integration.

Catch Cat - Super Game sends a generated install UUID to mymoneyrain.com when the extension is installed.

Catchpoint User Experience collects page URLs, performance timing, and resource waterfall data across all sites and forwards them to a locally-installed native host.

Cats-Tab Default Search sends searches typed in Chrome's default search box to www.cats-tab.xyz.

Character set fixer sends the signed-in user's Google email and subscription identifiers to pay.extensiondata.com.

Charlize sends Amazon product ASINs from viewed product pages to its product lookup API.

Chartink To TradingView sends selected Chartink stock symbols to a CloudFront endpoint before opening Kite.

Chat Plus sends selected Google Chat messages to its backend and uploads recorder media to Google Drive.

ChatGPT - Snack Prompt accepts page messages on ChatGPT that can submit prompts or open chosen URLs.

ChatGPT Assistant - Use AI Everywhere sends search queries, Gmail content, and selected text to ChatGPT.

ChatGPT Delete All Chats computes a persistent browser fingerprint on chatgpt.com and sends it to antonkhoteev.com on every API call.

ChatGPT Extension uploads user-selected image attachments to ImageBB before sending them to ChatGPT.

The extension reads clipboard text from prompt buttons and can submit it into ChatGPT or Gemini.

ChatTube sends YouTube transcripts, video details, chat prompts, and Firebase ID tokens to chattube.io.

Chrome Close Lock sends protection on/off status to intellibyte.net over cleartext HTTP.

Chrome Step ToolBox displays local Anki note metadata and media inside UWorld question pages.

Chromoji can post to Facebook as the logged-in user from its popup.

CiteMaker CiteWeb sends login passwords in GET requests to citemaker.com during popup sign-in.

Cityscapes sends each Chrome top-sites URL to Google's favicon service when it renders the new-tab page.

Claap removes Bubbles and Loom companion widgets from productivity sites where its content script runs.

Clean-Spam-Link-Tweet can send selected X/Twitter post text and account metadata to a developer report server.

Clear Cache Chrome includes a Google Analytics API secret in its shipped code and sends analytics events to Google.

Clear cookies for one site lets webpages trigger its cookie-clearing button for the current site.

ClipSave Video Downloader sends clicked Facebook video URLs and page metadata to clipsave.net for downloads.

Clipboard Tool polls the clipboard every second and stores copied text in local extension storage.

Clipper lets web pages invoke its page extraction and cloud clipping actions through a message bridge.

Cloud Print injects Google Analytics JavaScript into activated HTTP pages through its toolbar.

Coin Search reports each visited page URL and hostname to coinsearch.cash when rewards are enabled.

Color Code Finder reads page colors from every HTTP and HTTPS site and sends the computed palette to its extension runtime.

Color Picker captures the active tab image when you use its picker and sends recurring run events to Google Analytics.

Color Picker Tool & Eye Dropper captures the active tab screenshot for local color sampling when you use its picker.

Comment Exporter proxies exported Instagram commenter avatar URLs through cdn.getwebooster.workers.dev.

Comunidade ZDG FREE fetches and eval-executes a GitHub script inside WhatsApp Web after WhatsApp tabs load.

Console Importer injects a page helper on every site that can load user-selected remote JavaScript or CSS.

Consumer Rights Wiki reads page details locally to match visited shopping pages with consumer-rights information.

Contentsquare Tracking Setup Assistant records tracker request details and Contentsquare storage/cookies locally for setup checks.

Convert File sends a bundled ConvertAPI secret with each file-conversion request.