Low risk browser extensions

Ronin Wallet injects an Ethereum provider into all web pages and fetches an Amplitude script from cdn.amplitude.com with no integrity check.

Imageye - Image downloader lets users browse and download images from web pages.

Forecastfox loads its API URL configuration from s3blog.org on startup with no integrity check, then routes all weather and location queries through those URLs.

Streaming enhanced sends browsed content titles and locale to the TMDB API when the Show Rating feature is enabled.

Document Converter & Search overrides the browser default search engine to Yahoo using hardcoded affiliate tracking parameters.

Zoom Image opens a plain HTTP page on every extension update, exposing users to unencrypted content from the developer's server.

Terms of Service; Didn't Read displays crowd-sourced ToS ratings for the current site by fetching a service database from api.tosdr.org.

Chameleon contacts a GeoIP service when IP-based language or timezone spoofing is enabled.

XDM Browser Monitor v8+ intercepts cookies and request headers from all browser traffic and forwards them to a local download manager app.

7TV Nightly fetches a remote config to enumerate installed extensions and can disable flagged ones via the management API.

ProxTube transmits a persistent UUID to its operator server on every proxy, config, and domain-list request, and reports which other extensions are installed.

SimpleLogin exposes an unguarded postMessage handler on every page, letting any site script force navigation to the SimpleLogin dashboard.

Speed Dial 2 New tab page syncs bookmarks and per-site visit patterns to the vendor's server every two hours.

+Sub lets the current webpage request video details and frame thumbnails after the user clicks the extension.

1688 Search by Image & Image Downloader reads 1688 and Taobao login cookies for its shopping search features.

AEM Sidekick lets external webpages request temporary cache-bypass header changes for chosen HTTPS hosts.

AI Mind Maps Maker sends selected text and page or PDF URLs to livepolls.app when users create mind maps.

AI Sidebar weakens frame protections and changes fetch headers for pages opened inside its side panel.

ARIA DevTools loads Google-hosted Fira Code web fonts into pages when you activate its overlay.

ASI Alliance Wallet exposes a page bridge that lets any website lock the wallet.

Admitad Extension sends visited HTTPS page URLs and search-result links to Admitad's offers API for affiliate matching.

BlockGuard lets any web page replace its stored sign-in token and then sends that token to BlockGuard cloud APIs.

Advanced Java Launch relays page-supplied download specs to a native application to download and execute Java resources.

Agent Master sends matched-site page-view events to qcitems.com with a persistent client ID.

Alephium Extension Wallet exposes its extension runtime ID to every website where its content script runs.

AliExpress Business reports AliExpress product page visits to s.want.shop with the page URL, price, and product image.

AliSaver sends AliExpress product details to AliTools and Deals99 for price history, recommendations, wishlist, and cashback.

Appcues Builder accepts URL parameters from exposed extension pages and passes them into privileged builder actions.

AutoControl transmits a pseudonymous device ID, OS details, browser info, and usage statistics to its own server on install and update.

Gemini Automation sends a bundled client secret when it fetches remote configuration from its config servers.

Avatar Maker Studio exposes its extension ID in page DOM when quick access is enabled.

Bandcamp Tempo Adjust sends Bandcamp purchase dates to the Frankfurter exchange-rate API when you load purchases.

BearByLegacy lets any webpage open a transaction approval prompt without a prior dapp connection.

Best AI Art Generator (Free) - DiffusionDraw sends a FingerprintJS visitor ID with image-generation requests.

Best Proxy Switcher automatically disables other installed extensions that use proxy permissions.

Better ROBLOX Logo exposes its extension resource URL on Roblox pages while replacing the site icon.

BlankNewTab loads each new tab inside a remote iframe hosted on Amazon S3.

BlockP reads recent browser history locally to show usage statistics in its dashboard and onboarding pages.

Booking.com price tracker sends Booking.com page URLs, titles, referrers, and a persistent user ID to Google Analytics.

Bookmark Manager loads its popup with a remote Bootstrap stylesheet from maxcdn.bootstrapcdn.com.

Bouncer - Filter your X feed sends X post text and media URLs to Imbue for filtering over a WebSocket.

BrandSearch stores its access and refresh tokens with an encryption key bundled in the extension.

The extension lets any hebbank.com page connect to an arbitrary native messaging host on the user's OS without validation.

CFCA CertEnrollment.LNWL Extension exposes an unguarded externally_connectable bridge that lets any webpage connect to and send arbitrary messages to native hosts on the user's system.

CFCA CertEnrollment.UD Extension bridges CFCA web pages to native messaging hosts without validating the caller-supplied host name.

CFCA CryptoKit.SDRCB Extension bridges sdebank.com pages to local native messaging hosts without validating the host name supplied by the caller.

CSS Scan fetches stylesheet URLs through its background page and writes the responses into a page-readable iframe.

Cache Killer clears the browser cache before pages load when the user enables it.

CapMonster Cloud reads all cookies for the current site and attaches them to the captcha-solving request it sends to its own API.

Capios ships a disabled LinkedIn sharing branch with OAuth client secret and cookie values in web-accessible source.

Car Tab sends the hostnames of frequently visited sites to Google's favicon service when the new tab opens.

Career.io Job Auto Apply lets any webpage set Career.io account tokens in the extension through an unchecked app.html message.

Cars Lightning Speed sends your leaderboard nickname and score over cleartext HTTP to a Disney highscores server.

Cashdo lets any website ask the extension to open a caller-chosen URL in a new browser tab.

Catch Cat - Super Game sends a generated install UUID to mymoneyrain.com when the extension is installed.

ChatGPT - Snack Prompt accepts page messages on ChatGPT that can submit prompts or open chosen URLs.

ChatGPT for Google by cloudHQ sends Gmail account identifiers and page context to cloudHQ account-check endpoints.

Chrome Close Lock sends protection on/off status to intellibyte.net over cleartext HTTP.

Clear Cache Chrome includes a Google Analytics API secret in its shipped code and sends analytics events to Google.

Clear cookies for one site lets webpages trigger its cookie-clearing button for the current site.