Low risk browser extensions

Cashdo lets any website ask the extension to open a caller-chosen URL in a new browser tab.

Catch Cat - Super Game sends a generated install UUID to mymoneyrain.com when the extension is installed.

ChatGPT - Snack Prompt accepts page messages on ChatGPT that can submit prompts or open chosen URLs.

ChatGPT for Google by cloudHQ sends Gmail account identifiers and page context to cloudHQ account-check endpoints.

Chrome Close Lock sends protection on/off status to intellibyte.net over cleartext HTTP.

Clear Cache Chrome includes a Google Analytics API secret in its shipped code and sends analytics events to Google.

Clear cookies for one site lets webpages trigger its cookie-clearing button for the current site.

Clipper lets web pages invoke its page extraction and cloud clipping actions through a message bridge.

Color Picker captures the active tab image when you use its picker and sends recurring run events to Google Analytics.

Copilot by Global Technology rewrites Bing-matching requests and removes CSP and X-Frame-Options responses.

Copilot for Gmail by cloudHQ sends Gmail account lists and visible message contacts to cloudHQ for checks and CRM lookup.

Cornify records recent key codes on HTTP and HTTPS pages to detect the Konami sequence.

CreaSign bridges any webpage's postMessage calls to the locally installed CreaSign native app without validating the message origin.

Crunchyroll Enhancer - CrOptix reports certain German subtitle and watched-episode details to gateway4m.com.

DIAM Wallet lets any webpage provide the host and URL shown in its connection and signing approval prompts.

DesignFiles Product Clipper sends error reports with the active tab details and bookmarklet UUID to Sentry.

Desktop Screen Recorder lets any frame on the active tab trigger a screenshot capture and local PNG download.

The extension matches active tab URLs against remote config and tags matched domains on config.extaddon.site.

Dolby Voice 1.2 injects a content script on all pages that relays any webpage's postMessage commands to a native host without adequate origin validation.

Download Button sends extension action and settings telemetry to Google Analytics.

Downloader for Instagram - Promaster sends matched browsing URLs through a remote-configured affiliate redirect.

Dropified Dropshipping accepts external messages that can use your AliExpress session to edit carts and read order details.

DualPiP exposes a cross-extension fetch proxy that can send requested URLs, headers, and page content to any installed extension.

Duden-Mentor-Textprüfung sends text typed in supported webmail and WordPress editors to Duden's grammar API.

Dungeon Dodge can expose its extension ID to websites when its quick-access button is enabled.

EPROLO - Aliexpress product importer lets AliExpress URL parameters trigger cart additions and address-book updates.

ESUIT Bulk Videos Downloader removes Content-Security-Policy headers on scoped Facebook and esuit pages.

ESUIT | Delete My Activity for Facebook exposes its extension metadata to Facebook and ESUIT pages.

EXT — Faceit Intelligence loads its remote config and handles OAuth token exchange through a free dynamic-DNS subdomain, dmss.mooo.com.

Email Privacy Protector sends your Gmail address and locale details to cloudHQ during Gmail sessions.

EpubPress sends the full HTML of tabs you select to its own epub.press service to build your ebook.

Exa RIS/PACS Multi-monitor lets any website request display details and open popup windows through the extension.

Exploratory Tester exposes per-page fetch and XHR URL logs to page scripts on sites where it runs.

Export Followers free proxies Instagram profile avatar URLs through cdn.getwebooster.workers.dev in export results.

Ezoic lets any website that frames its Humix page update Ezoic video settings through videoapi.ezoic.com.

Eztrackr ships a developer VS Code Git IPC auth token and build environment values in its extension bundle.

Fable sends active-tab URLs to Segment and accepts page messages that forward URLs and page snippets to Fable.

Fast OCR lets any website trigger its web-accessible OCR page to send supplied images to remote OCR services.

Felo accepts postMessage commands from any webpage with no origin check, letting that page probe URLs and check your X/Xiaohongshu login.

FlareGet Integration captures session cookies and POST form data from all sites and forwards them to the local FlareGet download manager.

Flipkart Price Tracker sends Flipkart product identifiers to a proxy service and BuyHatke lookup URLs.

Floating Scientific Calculator sends current-page Sentry telemetry after page-triggered extension messages.

Fluvi Wallet exposes the selected wallet address to page scripts on every matched website.

Formatted Email Subject Lines by cloudHQ sends your Gmail address and extension metadata to cloudHQ on Gmail load.

Foxit PDF Editor Cloud lets websites invoke its viewer to fetch a supplied URL and pass the response to Foxit cloud.

FrankerFaceZ Nightly exposes its Twitch bridge settings commands to parent-page messages without origin checks.

FuseBase Assistant accepts session IDs from any webpage and sends them as Nimbus/FuseBase API headers.

GNT: Glass New Tab sends weather lookup requests to WeatherAPI.com from its new tab weather widget.

GQueues Chrome Extension sends your GQueues account identifier and product tier to Google Analytics.

GQueues for Google Calendar sends account-key and calendar-task interaction events to Google Analytics.

GSC Guardian blocks right-click, source-view, and common DevTools shortcuts on Google Search Console pages.

GamerPay extension lets allowed Steam and GamerPay pages use its bridge to read pending trades and send inventory data.

GateKeeper Password Manager communicates with a localhost credential API over HTTP when HTTPS is unavailable, sending session tokens in the URL.

Genius PRO fetches blocking rules over plaintext HTTP and installs returned domains as browser-wide block rules.

GigaBrain - AI Companion for Reddit sends Amazon product page details to thegigabrain.com when you view product pages.

Gladiatus Crazy Add On deletes localStorage entries used by competing Gladiatus bot scripts on Gladiatus pages.

Google 100 Results loads popup styles and fonts from Cloudflare and Google CDN servers.

Grammarly Dark loads its popup stylesheet from unpkg.com when the popup opens.

Grepolis Report Converter Revolution Tools loads remote scripts from grcrt.net and Google Tag Manager into Grepolis game pages.

GrowthBook DevTools lets any webpage overwrite its saved API host and API key through a postMessage bridge.