Low risk browser extensions

360 Internet Protection transmits tab URLs, page titles, and HTTP status codes to a locally installed native app on every navigation.

Authenticator stores TOTP codes locally and offers cloud backup via Google Drive, OneDrive, and Dropbox, with OAuth client secrets hardcoded in the distributed bundle.

Stores and autofills passwords, passkeys, payment details, personal notes, and files in a digital vault.

TouchEn PC보안 확장 relays arbitrary web pages' calls to a local native security agent and forwards each visited URL to that agent.

EndNote Click validates postMessage origins via substring match, allowing spoofed domains to relay commands to its PDF and export handlers.

Microsoft Bing Homepage & Search reads a Google Analytics attribution cookie from chrome.google.com and includes it in daily ping beacons sent to Microsoft.

Read Aloud accepts playback control commands from any installed Chrome extension without validating the sender.

Return YouTube Dislike injects an unsanitized version string from GitHub into the popup's innerHTML, enabling XSS if the remote file is tampered with.

Save to Pinterest adds your Pinterest user ID to Pinterest conversion-tracking requests when personalization settings allow it.

Google Dictionary sends a persistent UUID and lookup event data to Google Analytics on every dictionary or translation request.

TeraBox Download Assistant injects its extension ID into every page's DOM, allowing any website to detect that the extension is installed.

Adblock Plus injects a persistent installation UUID and account metadata into the DOM of every web page, readable by any page script.

BetterCampus fetches remotely-controlled CSS rules and sends Canvas school URLs and email domains to PostHog analytics by default.

Evernote Web Clipper accepts postMessage commands from any web page without verifying the sender's origin.

JSON Formatter embeds a GiveFreely affiliate tracking library that monitors shopping browsing and sends search result URLs across all websites.

AdGuard AdBlocker accepts a page event that can close the current browser tab during page startup.

AdBlocker Ultimate lets web pages trigger an extension event that closes the current browser tab.

Ace Script silently auto-updates userscripts, sends session cookies on cross-origin requests, and disables CSP on all websites.

Cyber-Ark Clipboard Extension adds a clipboard-write bridge to every page that any in-page script can use to overwrite clipboard contents.

DocuSign PKI writes the extension's runtime ID into the DOM on DocuSign signing pages, where other scripts on that page can read it.

ExpressVPN exposes VPN connection state and server coordinates to any website via an open external messaging channel.

Keep Awake your System or Display can auto-open a server-specified URL in a new tab on every browser startup, with no click required.

Repeek sends FACEIT match activity and Steam IDs to its own servers and fetches a remote config that controls all extension behavior.

Captures full-page or selected-area screenshots and opens them for editing and saving.

Tasks for Canvas sends the institution hostname, platform type, and usage metrics to the developer's server roughly once every 30 days.

Turn Off the Lights accepts color theme commands from any website via an unvalidated custom URL scheme handler.

Vue.js devtools runs on all pages to detect Vue.js and exposes build bundles with developer environment metadata to any website.

Web eID exposes eID card certificate retrieval and signing to all web pages via an unvalidated postMessage interface.

Yandex Access injects users' real IP addresses into proxied requests and sends daily telemetry with a persistent UUID to Yandex servers.

Sets Yandex as the browser’s default search provider.

Return YouTube Dislike assigns each user a persistent ID and sends it alongside video IDs and vote choices to its own API.

OneLogin for Google Chrome fetches and executes JavaScript functions from app.onelogin.com on every website the user visits.

Soda PDF Viewer intercepts all PDF navigations and forwards the full PDF URL, including any embedded auth tokens, to tools.sodapdf.com.

Turbo VPN sends your real IP address, account credentials, and session data to third-party analytics endpoints on every VPN connection.

Detects downloadable resources on webpages for users to capture.

SponsorBlock sends watched YouTube video IDs and skipped segment IDs to its server for skip-count telemetry.

Postman Interceptor captures browser HTTP requests and cookies and forwards them to the local Postman desktop app.

Tampermonkey BETA sends a persistent identifier and userscript names to its analytics server by default, without a consent prompt.

To Google Translate strips frame-blocking headers from Google Translate subframes without limiting the change to its own pages.

ImageAssistant patches XHR and fetch on every page to scan HTTP responses for image URLs, and sends a persistent per-install fingerprint to pullywood.com on startup.

Manages passwords, passkeys, authenticator codes, and autofill for online logins.

TWP - Translate Web Pages ships a hardcoded Google Translate API key in its extension bundle.

Grammarly sends per-domain typing metrics to its own servers and routes behavioral events to the third-party marketing platform Iterable.

MSN New Tab sends a daily telemetry ping over plain HTTP to g.ceipmsn.com with a persistent device identifier.

Microsoft Multimedia Redirection bridges browser audio/video to a native OS host and shares internal port identifiers across page iframes without origin restrictions.

RealityCheck sends the page's visible text to Anthropic's API and renders the streamed reply in its popup with unescaped HTML.

Augmented Steam sends Steam game app IDs to a third-party AI service (vaporlens.app) on every store page visit by default.

CXone Agent WebRTC Extension exposes system hardware metrics and microphone status to CRM pages on force.com and service-now.com via externally_connectable message handlers.

CrossPilot fetches and executes code from third-party URLs on every web page every 30 minutes.

E START sets the browser startup page to a plain-HTTP URL, sending each browser launch to start.jword.jp without encryption.

Muzli sends each top-visited site URL to Google's favicon service and reports usage telemetry to Google Analytics on every new tab open.

Picture in Picture - floating video player lets users watch videos in a floating window and injects a phantom pageview into the host page's Google Analytics queue on activation.

Work with Salesforce records, tasks, and engagement alerts from Gmail or alongside web pages.

Zoom Video injects a content script on every page to resize and reformat video elements using local controls only.

The extension sends its name and version number to csser.top on every Bilibili page visit via a hidden iframe.

LanguageTool transmits typed text and webmail recipient details to its own API servers during grammar checks.

Diccionario RAE en un clic 2022 sends selected text to dle.rae.es over plain HTTP when a user looks up a word.

Dragon Web Extension accepts cross-origin messages on all pages, allowing any window to trigger synthetic clicks on page elements.

This extension lets you annotate webpages, PDFs, and EPUBs for notes, research, and discussion.

Online PDF Editor (pdf2go.com) uploads Gmail attachment content to pdf2go.com cloud servers when a user clicks the in-Gmail compression button.