Low risk browser extensions

360 Internet Protection transmits tab URLs, page titles, and HTTP status codes to a locally installed native app on every navigation.

Authenticator stores TOTP codes locally and offers cloud backup via Google Drive, OneDrive, and Dropbox, with OAuth client secrets hardcoded in the distributed bundle.

Code analysis indicates Teleparty scrapes your complete Netflix viewing history and sends it to its own servers.

Stores and autofills passwords, passkeys, payment details, personal notes, and files in a digital vault.

TouchEn PC보안 확장 relays arbitrary web pages' calls to a local native security agent and forwards each visited URL to that agent.

EndNote Click validates postMessage origins via substring match, allowing spoofed domains to relay commands to its PDF and export handlers.

Microsoft Bing Homepage & Search reads a Google Analytics attribution cookie from chrome.google.com and includes it in daily ping beacons sent to Microsoft.

Save to Pinterest adds your Pinterest user ID to Pinterest conversion-tracking requests when personalization settings allow it.

Read Aloud accepts playback control commands from any installed Chrome extension without validating the sender.

Google Dictionary sends a persistent UUID and lookup event data to Google Analytics on every dictionary or translation request.

Secure Exam Proctor conceals all server domain names and API paths inside integer byte arrays throughout its code.

TeraBox Download Assistant injects its extension ID into every page's DOM, allowing any website to detect that the extension is installed.

Adblock Plus injects a persistent installation UUID and account metadata into the DOM of every web page, readable by any page script.

BetterCampus fetches remotely-controlled CSS rules and sends Canvas school URLs and email domains to PostHog analytics by default.

Evernote Web Clipper accepts postMessage commands from any web page without verifying the sender's origin.

AdGuard AdBlocker accepts a page event that can close the current browser tab during page startup.

AdBlocker Ultimate lets web pages trigger an extension event that closes the current browser tab.

Ace Script silently auto-updates userscripts, sends session cookies on cross-origin requests, and disables CSP on all websites.

Cyber-Ark Clipboard Extension adds a clipboard-write bridge to every page that any in-page script can use to overwrite clipboard contents.

DocuSign PKI writes the extension's runtime ID into the DOM on DocuSign signing pages, where other scripts on that page can read it.

EPUBReader exposes a reader page that any website can load to send HTTP requests to arbitrary URLs, including internal network addresses.

ExpressVPN exposes VPN connection state and server coordinates to any website via an open external messaging channel.

Keep Awake your System or Display can auto-open a server-specified URL in a new tab on every browser startup, with no click required.

Repeek sends FACEIT match activity and Steam IDs to its own servers and fetches a remote config that controls all extension behavior.

Captures full-page or selected-area screenshots and opens them for editing and saving.

Solventum Fluency Direct Web Connector exposes an unguarded CustomEvent bridge that lets any web page send commands to the locally-installed native host or overwrite extension storage.

Tasks for Canvas sends the institution hostname, platform type, and usage metrics to the developer's server roughly once every 30 days.

Turn Off the Lights accepts color theme commands from any website via an unvalidated custom URL scheme handler.

Vue.js devtools runs on all pages to detect Vue.js and exposes build bundles with developer environment metadata to any website.

Web eID exposes eID card certificate retrieval and signing to all web pages via an unvalidated postMessage interface.

Wordtune captures the full HTML content of AI chatbot pages and transmits it to its own servers.

Yandex Access injects users' real IP addresses into proxied requests and sends daily telemetry with a persistent UUID to Yandex servers.

uBlock sends daily encrypted per-domain telemetry to eyeo's servers and a persistent-UUID ping to ublock.org with OS and browser details.

Sets Yandex as the browser’s default search provider.

OneLogin for Google Chrome fetches and executes JavaScript functions from app.onelogin.com on every website the user visits.

Soda PDF Viewer intercepts all PDF navigations and forwards the full PDF URL, including any embedded auth tokens, to tools.sodapdf.com.

Turbo VPN sends your real IP address, account credentials, and session data to third-party analytics endpoints on every VPN connection.

Return YouTube Dislike assigns each user a persistent ID and sends it alongside video IDs and vote choices to its own API.

SponsorBlock sends watched YouTube video IDs and skipped segment IDs to its server for skip-count telemetry.

Postman Interceptor captures browser HTTP requests and cookies and forwards them to the local Postman desktop app.

Manages passwords, passkeys, authenticator codes, and autofill for online logins.

Tampermonkey BETA sends a persistent identifier and userscript names to its analytics server by default, without a consent prompt.

To Google Translate strips frame-blocking headers from Google Translate subframes without limiting the change to its own pages.

ImageAssistant patches XHR and fetch on every page to scan HTTP responses for image URLs, and sends a persistent per-install fingerprint to pullywood.com on startup.

Microsoft Multimedia Redirection bridges browser audio/video to a native OS host and shares internal port identifiers across page iframes without origin restrictions.

Netmirror Extension silently injects a Referer header pointing to fmoviesunblocked.net for any request containing a covert URL token.

TWP - Translate Web Pages ships a hardcoded Google Translate API key in its extension bundle.

Grammarly sends per-domain typing metrics to its own servers and routes behavioral events to the third-party marketing platform Iterable.

MSN New Tab sends a daily telemetry ping over plain HTTP to g.ceipmsn.com with a persistent device identifier.

Augmented Steam sends Steam game app IDs to a third-party AI service (vaporlens.app) on every store page visit by default.

CXone Agent WebRTC Extension exposes system hardware metrics and microphone status to CRM pages on force.com and service-now.com via externally_connectable message handlers.

CrossPilot fetches and executes code from third-party URLs on every web page every 30 minutes.

Diccionario RAE en un clic 2022 sends selected text to dle.rae.es over plain HTTP when a user looks up a word.