Low risk browser extensions

HBO Max Picture in Picture [QVI] sends Max profile-linked watch history and live sports viewing details to me3x.online.

HBO Max Speeder sends Max profile details and viewing activity to metricsmint.quest and me3x.online by default.

HP Dynamic Audio captures URLs, page titles, and media sources from streaming sites and forwards them to a locally installed native app.

HTML5 Universal Speed Hack injects timing hooks into every page and lets page messages change them.

HeyMax: Stack Miles & Rewards sends extension analytics events to Customer.io using credentials bundled in its content script.

Horus Web sends active-tab hostnames with local Horus agent identifiers to Horus BI endpoints during navigation.

Hulu Speeder: adjust playback speed [QVI] uploads Hulu watch history and profile identifiers to me3x.online by default.

IBM Connections Cloud Meetings bridges IBM Sametime meeting pages to a local native messaging host using a payload-field origin gate instead of event.origin.

ICBCAssistChromeExtension bridges ICBC bank web pages to a locally installed native application via native messaging.

IP Whois sends active-tab site IP geolocation lookups to ip-api.com over plaintext HTTP.

IPVanish Secure Browser lets any webpage display attacker-controlled HTML on its extension error page.

Iago - Learn Japanese through TV sends supported streaming-page URLs to Iago with a persistent extension device ID.

Image Downloader Pro Tool injects a page-visible DOM marker derived from its extension ID on every website.

Inbox When Ready for Gmail sends Gmail account identity and usage traits to Mixpanel analytics.

Integral CertHandler relays unvalidated CustomEvent commands from any web page to a native certificate-handling app.

Istoric Preturi applies API-supplied regexes to product-page HTML and sends captured matches to its API.

JabRef Browser Extension fetches translator scripts from repo.zotero.org and executes them in active tabs without integrity checks.

Jazz-MIDI exposes a native MIDI host to any website via a CustomEvent bridge with no origin filtering.

KarmineCorp sends a persistent extension identifier and selected notification preferences to api2.kametotv.fr.

Kimi 阅读助手 can send tab URLs from its web-accessible sidepanel to apphunt.site.

Kiosk Extension writes its plaintext admin unlock password into a visible page element, readable without logging in.

Kwai Pixel Helper removes CSP and X-Frame-Options headers from every sub-frame response and rewrites frame user agents.

Laitis Browser Extension relays commands from a local native app to inject scripts, proxy HTTP requests, and read content from any web page.

Lingvanex sends the user's plaintext email address to PostHog analytics on every account login.

LinuxDo Scripts sends linux.do forum content to user-configured AI API endpoints and backs up settings to a user-configured WebDAV server.

Lofi Girl contacts geolocation-db.com from its popup to infer the user's country on first open.

Lumina Night Mode fetches cross-origin stylesheets and places their contents into page-readable DOM.

MSN Homepage, Bing Search & News sends a Bing MUID cookie and persistent machine ID to g.ceipmsn.com during telemetry pings.

MYO Studio sends icon search requests with an embedded Yotoicons API key.

MailMaestro reports the active Gmail account email address to app.maestrolabs.com when Gmail loads.

Mailinblack lets any website set its trusted service URL before the first legitimate connection.

McAfee SafeKey fetches server-controlled JavaScript from its vendor and executes it in every page's DOM.

Meditation Search loads a remote S3 page each time you open its new-tab page.

MeetMe Dolby Voice 1.1 relays postMessages from any web page to a native messaging host with no origin validation.

Microsoft Bing Homepage & News sends persistent Bing and local identifiers to g.ceipmsn.com over HTTP.

Mokku exposes saved mock responses and header rules to any website through its page message bridge.

Multi Skipper sends streaming profile details and continue-watching history from several services to external analytics endpoints.

MyWallPaper fetches the user's public IP address from ident.me over cleartext HTTP on the new tab page.

NFC Reader - Browser Extension relays arbitrary commands from any webpage to a locally connected NFC reader via native messaging.

NanoInfluencer.ai exposes its extension manifest and persistent app ID to any top-level web page.

Next Experience Developer Tools exposes its persistent extension ID to page scripts on every website.

NipahTV sends the user's Kick channel presence to 7tv.io when its default-enabled 7TV add-on runs.

OnHub Recovery Utility sends recovery target and USB drive details to Google Analytics when crash reporting allows it.

Open bookmarks in a new tab lets its bookmark proxy page redirect the current tab to a URL chosen in the page address.

OpenMask lets a page supply the dApp origin used for wallet authorization checks.

OpenTabs sends new-tab search terms and its click_id cookie to p.opentabs.org.

Ostendo sends YouTube feature-use events with a persistent extension client ID to Google Analytics.

PDF Combine - Convert and Merge sends a bundled Online-Convert API key with remote conversion requests.

Parti Wallet lets connected sites ask for a wallet signing prompt using a saved connection ID.

Password Boss reads form field values on all web pages and forwards them to the local Password Boss desktop app via native messaging.

Photo Zoom fetches server-supplied scripts and evaluates them in its all-sites content script.

Pieces for Developers lets any website request stored Pieces identifiers and site history state through a page message bridge.

Pinbox checks active tab URLs with withpinbox.com and sends saved pages, selected text, and images to its API.

Pinterest Pin Stats - Sort Pins validates saved license keys with InsightPins.

Plerdy SEO Analyzer accepts page messages that can replace its stored Plerdy token and send SEO audit data to Plerdy.

Popup Blocker injects a hidden, id-tagged element into every page it runs on, letting any site detect that it's installed.

PorNo! Porn Blocker lets any web page save redirect URLs into its Chrome sync storage.

Prime Cinema mirrors its site cookies into browser sync storage and rewrites them as JavaScript-readable cookies.

Prime Video Picture In Picture [QVI] sends Prime Video profile, contact, viewing, subscription, and payment data to remote servers.

Print Notion stores your Notion access token in chrome.storage.sync instead of local storage, so it syncs across your Chrome devices.