Fun extensions

YouTube Stats Viewer sends YouTube video IDs to returnyoutubedislikeapi.com for dislike and engagement metrics.

dddice forwards tabletop dice-roll details from supported VTT pages to dddice.com.

Adventure Time Wallpaper sends top visited site URLs to Google's favicon service on its new-tab page.

Bunny & Rabbit Wallpaper sends your new-tab top-site URLs to Google's favicon service.

Chess.com Custom Pieces & GIF Background sets a fixed Chess.com referral cookie on matching pages.

Classic Games for Chrome loads Playtik game iframes from any webpage where a user opens a game.

Cursor Traveler: mouse move counter measures mouse movement on every page and stores daily distance totals locally.

Final Fantasy 7 Remake Wallpaper sends top-site URLs from its new tab page to Google's favicon service.

Freshy Recipes can send your Chrome top-sites list to its remote new-tab page.

Funny Gru rewrites images, backgrounds, cursor styling, audio, and new-tab pages across all websites.

Lamborghini wallpapers loads Gameograf-controlled HTML into its new-tab and popup pages.

Lionel Messi Barcelona Wallpapers loads remote Gameograf content into its new-tab page without sanitizing it.

MHCT MouseHunt Helper sends MouseHunt hunt records and crown counts to MHCT and Google Apps Script endpoints.

Minecraft Cursor loads Google Fonts in its popup and opens Yowgames pages during install and uninstall.

My Hero Academia Chibi Wallpaper sends top-site URLs to Google's favicon service on each new tab.

Picture In Picture for Pluto TV [QVI] sends Pluto profiles, bookmarks, continue-watching, and playback event data to metricmuse.xyz.

Pocket Bird loads a remote jsDelivr font when its overlay UI opens on a page.

Puppies & Dogs Cursor injects a site-visible cursor style marker into every webpage.

Roblox Characters Custom Cursor loads selected cursor images from allcursor.com on pages you visit.

Shared Music reads your Google Meet account email and sends it through cors.deno.dev to api.sharedmusic.app.

The Gay Agenda loads pride-flag images from Wikimedia whenever its popup is opened.

TrollFace Everywhere replaces page images with a bundled trollface and redirects YouTube watch pages to a fixed video.

Worldview embeds an ArcGIS access token and sends map coordinates to ArcGIS services for geocoding and suggestions.

Apple TV SubStyler collects Apple TV viewing, subscription, and account profile data for metricmuse.xyz and metricsmint.quest.

Astronomy Picture of the Day APOD sends Chrome top-sites URLs to Google's favicon service on new tabs.

Best Smooth Jazz loads its radio stream over cleartext HTTP.

Bungo Stray Dogs Wallpaper sends your most-visited site URLs to Google's favicon service on each new-tab page.

Custom Cursor Pro sends selected cursor image requests from visited pages to cdn.custom-cursors.com.

Custom Cursor for Chrome changes the cursor on every site and broadcasts its extension ID to pages.

Custom Tab For Chrome sends new-tab geolocation coordinates to panel.onlynewtab.com for weather lookup.

Gladiatus Helper Bot sends in-game private and guild message text to its Telegram webhook backend.

Good Tab opens each new tab by navigating it to tab.pledgeasmile.com.

Hijinx sends Google Meet profile details and a generated player ID to its Firebase room database.

JDM Cursor inserts a visible style marker on every site that includes part of its extension ID.

ListenOnRepeat: Youtube to LOR ships a Google YouTube Data API key in its popup playlist request.

Liver sends popup requests to Holodex with a bundled API key.

My Cursors marks every HTTP and HTTPS page with a style class derived from its extension ID.

My Dress-Up Darling Wallpaper sends top visited page URLs to Google's favicon service on the new-tab page.

Openwhyd track sends the active page details and selected track information to openwhyd.org when you post or search.

Overlord Wallpaper sends top-site URLs from the new-tab page to Google's favicon service.

Page Pranker modifies pages you visit by blurring, rotating, fading, recoloring, and hiding the cursor on page elements.

Radio Player Live loads its station catalog and changelog over plaintext HTTP from calidigy.free.fr.

Rick and Morty Wallpaper sends top-sites domains to Google's favicon service when its Most Visited widget loads.

Searcher for Discogs sends selected artist, style, and track metadata to Google Analytics.

Skin|Chess.com has no confirmed data-recipient behavior in the reviewed records.

Squid Game Cursor injects CSS cursor URLs containing its extension ID into pages after a cursor is enabled.

Tab Lasso loads Google Fonts from its new tab page, sending request metadata to Google font domains.

Tanjiro Kamado Kimetsu No Yaiba Gameograf renders remote popup HTML inside its new-tab page.

Tokyo Ghoul Wallpaper sends most-visited site domains to Google when its new-tab page shows favicons.

Wall of Marvel loads its new-tab background image over plaintext HTTP from CloudFront.

Windows Update opens a local fake update page and makes the active browser window fullscreen.

lavender | new tab sends precise coordinates to OpenWeatherMap when its new-tab weather feature is used.

Nike MeaVana sends the IP Info utility's public IP lookup to ip-api.com over cleartext HTTP.

HTnini writes its extension runtime ID into the Hattrick page DOM when its in-page UI opens.

Labubu Cursor accepts postMessage commands from any web page and fetches attacker-supplied URLs with the user's credentials.