Well-being extensions

Ripple Tool sends raw mental-health search queries to Mixpanel and injects server-controlled HTML into search-engine pages.

YouTube Row Fixer exposes its storage preferences to scripts running on YouTube pages.

SocialFocus fetches server-controlled CSS selectors from untrap.app and applies them to social media pages without integrity validation.

BlankNewTab loads each new tab inside a remote iframe hosted on Amazon S3.

Coin Search reports each visited page URL and hostname to coinsearch.cash when rewards are enabled.

PorNo! Porn Blocker lets any web page save redirect URLs into its Chrome sync storage.

GoodPlan sends a generated FingerprintJS visitor ID to its referral endpoint during first-run setup.

Reminder captures copied and cut text from every website and stores it in local clipboard history.

Escape Goose inserts user-uploaded meme images into every page you visit.

iTour chat translation sends page text for translation to a cleartext HTTP endpoint.

Eye Saver - Break Reminder injects readable extension font URLs into every page it runs on.

Aanmeldgemak - Easyzorg opens Secuform/Easyzorg URLs with the client ID from supported care-system pages.

Breathhh sends visited site origins and focus activity to Breathhh API and websocket servers.

Nur | Qur'an in new tab can send displayed most-visited site URLs to Google's favicon service.

Garmin Badge Database sends Garmin Connect badge and challenge details to garminbadges.com after the user clicks Update.

YT Music Karaoke sends the current YouTube Music song and artist to its lyrics lookup backend.

clearspace sends feedback submissions with account details to a hardcoded Slack webhook.

Idle Forest bundles the Mellowtel SDK, which loads pages in a hidden tab and sends their content to Mellowtel's servers.

Sentience runs its wallet's plugin sandbox inside its own marketing website instead of MetaMask's isolated execution page.

Find Real Friends reads the full text of your ChatGPT conversations and sends them to its own server.