Low risk browser extensions

Best Proxy Switcher automatically disables other installed extensions that use proxy permissions.

Better ROBLOX Logo exposes its extension resource URL on Roblox pages while replacing the site icon.

BlockP reads recent browser history locally to show usage statistics in its dashboard and onboarding pages.

Booking.com price tracker sends Booking.com page URLs, titles, referrers, and a persistent user ID to Google Analytics.

Bookmark Manager loads its popup with a remote Bootstrap stylesheet from maxcdn.bootstrapcdn.com.

Bouncer - Filter your X feed sends X post text and media URLs to Imbue for filtering over a WebSocket.

BrandSearch stores its access and refresh tokens with an encryption key bundled in the extension.

The extension lets any hebbank.com page connect to an arbitrary native messaging host on the user's OS without validation.

CFCA CertEnrollment.UD Extension bridges CFCA web pages to native messaging hosts without validating the caller-supplied host name.

CFCA CryptoKit.SDRCB Extension bridges sdebank.com pages to local native messaging hosts without validating the host name supplied by the caller.

CFCA CryptoKit relays messages from yljr.com pages to a native messaging host named by the page.

CSS Scan fetches stylesheet URLs through its background page and writes the responses into a page-readable iframe.

Cache Killer clears the browser cache before pages load when the user enables it.

CapMonster Cloud reads all cookies for the current site and attaches them to the captcha-solving request it sends to its own API.

Capios ships a disabled LinkedIn sharing branch with OAuth client secret and cookie values in web-accessible source.

Car Tab sends the hostnames of frequently visited sites to Google's favicon service when the new tab opens.

Career.io Job Auto Apply lets any webpage set Career.io account tokens in the extension through an unchecked app.html message.

Cashdo lets any website ask the extension to open a caller-chosen URL in a new browser tab.

Catch Cat - Super Game sends a generated install UUID to mymoneyrain.com when the extension is installed.

ChatGPT - Snack Prompt accepts page messages on ChatGPT that can submit prompts or open chosen URLs.

ChatGPT for Google by cloudHQ sends Gmail account identifiers and page context to cloudHQ account-check endpoints.

Chrome Close Lock sends protection on/off status to intellibyte.net over cleartext HTTP.

Clear Cache Chrome includes a Google Analytics API secret in its shipped code and sends analytics events to Google.

Clear cookies for one site lets webpages trigger its cookie-clearing button for the current site.

Click Image Download lets page-generated alt-click events trigger extension-managed image downloads.

Clinical Notes AI registers each page URL and domain as PostHog properties from its broad content script.

Clipper lets web pages invoke its page extraction and cloud clipping actions through a message bridge.

Livescratch lets Scratch pages request its stored LiveScratch bearer token through an external messaging bridge.

Color Picker captures the active tab image when you use its picker and sends recurring run events to Google Analytics.

Comix Downloader sends a hashed ID of every comix.to profile you visit to its own server, with no opt-out.

Copilot by Global Technology rewrites Bing-matching requests and removes CSP and X-Frame-Options responses.

Cornify records recent key codes on HTTP and HTTPS pages to detect the Konami sequence.

CreaSign bridges any webpage's postMessage calls to the locally installed CreaSign native app without validating the message origin.

DIAM Wallet lets any webpage provide the host and URL shown in its connection and signing approval prompts.

DesignFiles Product Clipper sends error reports with the active tab details and bookmarklet UUID to Sentry.

Desktop Screen Recorder lets any frame on the active tab trigger a screenshot capture and local PNG download.

The extension matches active tab URLs against remote config and tags matched domains on config.extaddon.site.

Dolby Voice 1.2 injects a content script on all pages that relays any webpage's postMessage commands to a native host without adequate origin validation.

Download Button sends extension action and settings telemetry to Google Analytics.

Downloader for Instagram - Promaster sends matched browsing URLs through a remote-configured affiliate redirect.

Duden-Mentor-Textprüfung sends text typed in supported webmail and WordPress editors to Duden's grammar API.

Dungeon Dodge can expose its extension ID to websites when its quick-access button is enabled.

EPROLO - Aliexpress product importer lets AliExpress URL parameters trigger cart additions and address-book updates.

ESUIT Bulk Videos Downloader removes Content-Security-Policy headers on scoped Facebook and esuit pages.

ESUIT | Delete My Activity for Facebook exposes its extension metadata to Facebook and ESUIT pages.

EpubPress sends the full HTML of tabs you select to its own epub.press service to build your ebook.

Exa RIS/PACS Multi-monitor lets any website request display details and open popup windows through the extension.

Exploratory Tester exposes per-page fetch and XHR URL logs to page scripts on sites where it runs.

Ezoic lets any website that frames its Humix page update Ezoic video settings through videoapi.ezoic.com.

Eztrackr ships a developer VS Code Git IPC auth token and build environment values in its extension bundle.

Fast OCR lets any website trigger its web-accessible OCR page to send supplied images to remote OCR services.

Felo accepts postMessage commands from any webpage with no origin check, letting that page probe URLs and check your X/Xiaohongshu login.

FlareGet Integration captures session cookies and POST form data from all sites and forwards them to the local FlareGet download manager.

Flipkart Price Tracker sends Flipkart product identifiers to a proxy service and BuyHatke lookup URLs.

Fluvi Wallet exposes the selected wallet address to page scripts on every matched website.

Follower Watch - IG Tracker routes Instagram profile image URLs through a workers.dev proxy.

FrankerFaceZ Nightly exposes its Twitch bridge settings commands to parent-page messages without origin checks.

FuseBase Assistant accepts session IDs from any webpage and sends them as Nimbus/FuseBase API headers.