Low risk browser extensions

LibKey Nomad assigns a persistent device UUID and transmits it alongside browser details to a.thirdiron.com on every article interaction.

Productivity Boost & Search overrides the default search engine to Yahoo with affiliate tracking and sends IPs to productivityboost.net.

Internet Archive Downloader sets CORS headers on archive.org responses to allow credentialed cross-origin fetches when downloading books.

Cashback Assistent von Shoop.de injects a version meta tag into every page and sends analytics to Google via a hardcoded API secret.

Season Pass Pass intercepts Bungie API keys from network headers and redirects Settings API calls to a third-party Cloudflare Worker.

Reverse Image Search exposes a web-accessible page that accepts form-submit commands via postMessage from any web origin.

MAL-Sync embeds hardcoded OAuth client secrets for three third-party services in its extension bundle.

Video Downloader - Video Hunter sends every TikTok URL you visit to third-party download services without requiring user action.

WebRTC Leak Shield permanently exempts its developer domain 'interdrop.com' from WebRTC blocking without disclosing this to the user.

User-Agent Switcher writes the configured UA string to each page's localStorage, where any page script can read it.

Runet Censorship Bypass routes browser traffic through third-party proxies and re-fetches its PAC script from remote URLs every 12 hours.

Pixiv Toolkit overrides CORS headers on Pixiv and pximg domains, allowing any webpage to read image resources cross-origin.

Open in IE exposes a shared DOM channel that any webpage can use to open an attacker-chosen URL in Internet Explorer.

Substital embeds the GiveFreely affiliate SDK and sends device and user IDs to GiveFreely when its popup opens on merchant sites.

SeoQuake SEO extension sends the domain and URL of every page visited to Semrush-owned API servers on all websites.

FantasyPros injects a content script on all pages that can be triggered by any site to read and transmit a user's Sleeper auth token.

YouTube mp3 Downloader sends the current YouTube video URL to videomp3convert.com when the download button is clicked.

anonymoX allows its VPN master server to open arbitrary URLs in new tabs on every periodic check-in.

Streaming enhanced sends browsed content titles and locale to the TMDB API when the Show Rating feature is enabled.

Notefox: websites notes collects page URLs and user interaction events via default-enabled telemetry and syncs them to notefox.eu.

Document Converter & Search overrides the browser default search engine to Yahoo using hardcoded affiliate tracking parameters.

RetailMeNot: Codes, Cash Back and Coupons transmits full page DOM content from shopping and checkout pages to api.onsleek.ai via the Sleek SDK.

Destiny 2 Season Pass Wayback Machine ships a hardcoded Bungie Platform API key in its extension bundle.

Video Downloader's content script has an unguarded message handler that sends the current URL and accepts DOM injection from any origin.

Ronin Wallet injects an Ethereum provider into all web pages and fetches an Amplitude script from cdn.amplitude.com with no integrity check.

Tasks for Canvas™ sends the school's hostname to the developer's analytics server at most once every 30 days.

Imageye - Image downloader lets users browse and download images from web pages.

Forecastfox loads its API URL configuration from s3blog.org on startup with no integrity check, then routes all weather and location queries through those URLs.

XDM Browser Monitor v8+ intercepts cookies and request headers from all browser traffic and forwards them to a local download manager app.

Zoom Image opens a plain HTTP page on every extension update, exposing users to unencrypted content from the developer's server.

Terms of Service; Didn't Read displays crowd-sourced ToS ratings for the current site by fetching a service database from api.tosdr.org.

Chameleon contacts a GeoIP service when IP-based language or timezone spoofing is enabled.

7TV Nightly fetches a remote config to enumerate installed extensions and can disable flagged ones via the management API.

ProxTube transmits a persistent UUID to its operator server on every proxy, config, and domain-list request, and reports which other extensions are installed.

SimpleLogin exposes an unguarded postMessage handler on every page, letting any site script force navigation to the SimpleLogin dashboard.

Speed Dial 2 New tab page syncs bookmarks and per-site visit patterns to the vendor's server every two hours.

+Sub lets the current webpage request video details and frame thumbnails after the user clicks the extension.

1688 search by image uploads product images you pick to image-search backends, and any web page can trigger that upload.

AI Mind Maps Maker sends selected text and page or PDF URLs to livepolls.app when users create mind maps.

AI Sidebar weakens frame protections and changes fetch headers for pages opened inside its side panel.

ARIA DevTools loads Google-hosted Fira Code web fonts into pages when you activate its overlay.

ASI Alliance Wallet exposes a page bridge that lets any website lock the wallet.

Admitad Extension sends visited HTTPS page URLs and search-result links to Admitad's offers API for affiliate matching.

BlockGuard lets any web page replace its stored sign-in token and then sends that token to BlockGuard cloud APIs.

Advanced Java Launch relays page-supplied download specs to a native application to download and execute Java resources.

Agent Master sends matched-site page-view events to qcitems.com with a persistent client ID.

AiPrice(AliPrice) Search by Image for Amazon tracks matched browsing URLs and sends them to api.aliprice.com.

Alephium Extension Wallet exposes its extension runtime ID to every website where its content script runs.

AliExpress Business reports AliExpress product page visits to s.want.shop with the page URL, price, and product image.

AliSaver sends AliExpress product details to AliTools and Deals99 for price history, recommendations, wishlist, and cashback.

Appcues Builder accepts URL parameters from exposed extension pages and passes them into privileged builder actions.

Music and Audio Catcher watches web requests on all sites to find playable media and saves media URLs locally.

AutoControl transmits a pseudonymous device ID, OS details, browser info, and usage statistics to its own server on install and update.

Autofill Taobao Tracking No. & Shipping Info records matched tab URLs and sends domains to AliPrice endpoints.

Gemini Automation sends a bundled client secret when it fetches remote configuration from its config servers.

VEO Automation authenticates the Pro side panel by email alone, unlocking paid features without proving mailbox ownership.

Avatar Maker Studio exposes its extension ID in page DOM when quick access is enabled.

Bandcamp Tempo Adjust sends Bandcamp purchase dates to the Frankfurter exchange-rate API when you load purchases.

BearByLegacy lets any webpage open a transaction approval prompt without a prior dapp connection.

Best AI Art Generator (Free) - DiffusionDraw sends a FingerprintJS visitor ID with image-generation requests.