Low risk browser extensions

Click Image Download lets page-generated alt-click events trigger extension-managed image downloads.

Clipper lets web pages invoke its page extraction and cloud clipping actions through a message bridge.

Color Picker captures the active tab image when you use its picker and sends recurring run events to Google Analytics.

Copilot by Global Technology rewrites Bing-matching requests and removes CSP and X-Frame-Options responses.

Copilot for Gmail by cloudHQ sends Gmail account lists and visible message contacts to cloudHQ for checks and CRM lookup.

Cornify records recent key codes on HTTP and HTTPS pages to detect the Konami sequence.

CreaSign bridges any webpage's postMessage calls to the locally installed CreaSign native app without validating the message origin.

DIAM Wallet lets any webpage provide the host and URL shown in its connection and signing approval prompts.

DesignFiles Product Clipper sends error reports with the active tab details and bookmarklet UUID to Sentry.

Desktop Screen Recorder lets any frame on the active tab trigger a screenshot capture and local PNG download.

The extension matches active tab URLs against remote config and tags matched domains on config.extaddon.site.

Dolby Voice 1.2 injects a content script on all pages that relays any webpage's postMessage commands to a native host without adequate origin validation.

Download Button sends extension action and settings telemetry to Google Analytics.

Downloader for Instagram - Promaster sends matched browsing URLs through a remote-configured affiliate redirect.

Dropified Dropshipping accepts external messages that can use your AliExpress session to edit carts and read order details.

Duden-Mentor-Textprüfung sends text typed in supported webmail and WordPress editors to Duden's grammar API.

Dungeon Dodge can expose its extension ID to websites when its quick-access button is enabled.

EPROLO - Aliexpress product importer lets AliExpress URL parameters trigger cart additions and address-book updates.

ESUIT Bulk Videos Downloader removes Content-Security-Policy headers on scoped Facebook and esuit pages.

ESUIT | Delete My Activity for Facebook exposes its extension metadata to Facebook and ESUIT pages.

Email Privacy Protector sends your Gmail address and locale details to cloudHQ during Gmail sessions.

EpubPress sends the full HTML of tabs you select to its own epub.press service to build your ebook.

Exa RIS/PACS Multi-monitor lets any website request display details and open popup windows through the extension.

Exploratory Tester exposes per-page fetch and XHR URL logs to page scripts on sites where it runs.

Ezoic lets any website that frames its Humix page update Ezoic video settings through videoapi.ezoic.com.

Eztrackr ships a developer VS Code Git IPC auth token and build environment values in its extension bundle.

Fast OCR lets any website trigger its web-accessible OCR page to send supplied images to remote OCR services.

Felo accepts postMessage commands from any webpage with no origin check, letting that page probe URLs and check your X/Xiaohongshu login.

FlareGet Integration captures session cookies and POST form data from all sites and forwards them to the local FlareGet download manager.

Flipkart Price Tracker sends Flipkart product identifiers to a proxy service and BuyHatke lookup URLs.

Fluvi Wallet exposes the selected wallet address to page scripts on every matched website.

Follower Watch - IG Tracker routes Instagram profile image URLs through a workers.dev proxy.

Formatted Email Subject Lines by cloudHQ sends your Gmail address and extension metadata to cloudHQ on Gmail load.

Foxit PDF Editor Cloud lets websites invoke its viewer to fetch a supplied URL and pass the response to Foxit cloud.

FrankerFaceZ Nightly exposes its Twitch bridge settings commands to parent-page messages without origin checks.

FuseBase Assistant accepts session IDs from any webpage and sends them as Nimbus/FuseBase API headers.

GNT: Glass New Tab sends weather lookup requests to WeatherAPI.com from its new tab weather widget.

GQueues Chrome Extension sends your GQueues account identifier and product tier to Google Analytics.

GQueues for Google Calendar sends account-key and calendar-task interaction events to Google Analytics.

GSC Guardian blocks right-click, source-view, and common DevTools shortcuts on Google Search Console pages.

GamerPay extension lets allowed Steam and GamerPay pages use its bridge to read pending trades and send inventory data.

Genius PRO fetches blocking rules over plaintext HTTP and installs returned domains as browser-wide block rules.

GigaBrain - AI Companion for Reddit sends Amazon product page details to thegigabrain.com when you view product pages.

Gladiatus Crazy Add On deletes localStorage entries used by competing Gladiatus bot scripts on Gladiatus pages.

Google 100 Results loads popup styles and fonts from Cloudflare and Google CDN servers.

Grammarly Dark loads its popup stylesheet from unpkg.com when the popup opens.

Grepolis Report Converter Revolution Tools loads remote scripts from grcrt.net and Google Tag Manager into Grepolis game pages.

GrowthBook DevTools lets any webpage overwrite its saved API host and API key through a postMessage bridge.

HBO Max Picture in Picture [QVI] sends Max profile-linked watch history and live sports viewing details to me3x.online.

HBO Max Speeder sends Max profile details and viewing activity to metricsmint.quest and me3x.online by default.

HP Dynamic Audio captures URLs, page titles, and media sources from streaming sites and forwards them to a locally installed native app.

HeyMax: Stack Miles & Rewards sends extension analytics events to Customer.io using credentials bundled in its content script.

Horus Web sends active-tab hostnames with local Horus agent identifiers to Horus BI endpoints during navigation.

Hulu Speeder: adjust playback speed [QVI] uploads Hulu watch history and profile identifiers to me3x.online by default.

IBM Connections Cloud Meetings bridges IBM Sametime meeting pages to a local native messaging host using a payload-field origin gate instead of event.origin.

ICBCAssistChromeExtension bridges ICBC bank web pages to a locally installed native application via native messaging.

IP Whois sends active-tab site IP geolocation lookups to ip-api.com over plaintext HTTP.

IPVanish Secure Browser lets any webpage display attacker-controlled HTML on its extension error page.

Iago - Learn Japanese through TV sends supported streaming-page URLs to Iago with a persistent extension device ID.

Image Downloader Pro Tool injects a page-visible DOM marker derived from its extension ID on every website.