Low risk browser extensions

Inbox When Ready for Gmail sends Gmail account identity and usage traits to Mixpanel analytics.

Integral CertHandler relays unvalidated CustomEvent commands from any web page to a native certificate-handling app.

Istoric Preturi applies API-supplied regexes to product-page HTML and sends captured matches to its API.

J7Extension captures Axiom tracked-wallet and own-wallet details for its local highlighting panel.

JabRef Browser Extension fetches translator scripts from repo.zotero.org and executes them in active tabs without integrity checks.

Jazz-MIDI exposes a native MIDI host to any website via a CustomEvent bridge with no origin filtering.

Kakadu VPN: One Family routes browser traffic through a Kakadu-provided HTTP proxy when VPN mode is connected.

KarmineCorp sends a persistent extension identifier and selected notification preferences to api2.kametotv.fr.

Kiosk Extension writes its plaintext admin unlock password into a visible page element, readable without logging in.

Kwai Pixel Helper removes CSP and X-Frame-Options headers from every sub-frame response and rewrites frame user agents.

Laitis Browser Extension relays commands from a local native app to inject scripts, proxy HTTP requests, and read content from any web page.

Lector Biblioteca Ceibal lets approved reading sites query and remove matching browser bookmarks.

Lingvanex sends the user's plaintext email address to PostHog analytics on every account login.

LinuxDo Scripts sends linux.do forum content to user-configured AI API endpoints and backs up settings to a user-configured WebDAV server.

Lofi Girl contacts geolocation-db.com from its popup to infer the user's country on first open.

Lumina Night Mode fetches cross-origin stylesheets and places their contents into page-readable DOM.

MSN Homepage, Bing Search & News sends a Bing MUID cookie and persistent machine ID to g.ceipmsn.com during telemetry pings.

MYO Studio sends icon search requests with an embedded Yotoicons API key.

MailMaestro reports the active Gmail account email address to app.maestrolabs.com when Gmail loads.

Mailinblack lets any website set its trusted service URL before the first legitimate connection.

McAfee SafeKey fetches server-controlled JavaScript from its vendor and executes it in every page's DOM.

Meditation Search loads a remote S3 page each time you open its new-tab page.

MeetMe Dolby Voice 1.1 relays postMessages from any web page to a native messaging host with no origin validation.

Microsoft Bing Homepage & News sends persistent Bing and local identifiers to g.ceipmsn.com over HTTP.

Mokku exposes saved mock responses and header rules to any website through its page message bridge.

Multi Skipper sends streaming profile details and continue-watching history from several services to external analytics endpoints.

NanoInfluencer.ai exposes its extension manifest and persistent app ID to any top-level web page.

Next Experience Developer Tools exposes its persistent extension ID to page scripts on every website.

NipahTV sends the user's Kick channel presence to 7tv.io when its default-enabled 7TV add-on runs.

OnHub Recovery Utility sends recovery target and USB drive details to Google Analytics when crash reporting allows it.

OpenMask lets a page supply the dApp origin used for wallet authorization checks.

OpenTabs sends new-tab search terms and its click_id cookie to p.opentabs.org.

Ostendo sends YouTube feature-use events with a persistent extension client ID to Google Analytics.

PDF Combine - Convert and Merge sends a bundled Online-Convert API key with remote conversion requests.

Parti Wallet lets connected sites ask for a wallet signing prompt using a saved connection ID.

Password Boss reads form field values on all web pages and forwards them to the local Password Boss desktop app via native messaging.

Photo Zoom fetches server-supplied scripts and evaluates them in its all-sites content script.

Pieces for Developers lets any website request stored Pieces identifiers and site history state through a page message bridge.

Pinbox checks active tab URLs with withpinbox.com and sends saved pages, selected text, and images to its API.

Pinterest Pin Stats - Sort Pins validates saved license keys with InsightPins.

Plerdy SEO Analyzer accepts page messages that can replace its stored Plerdy token and send SEO audit data to Plerdy.

Popup Blocker injects a hidden, id-tagged element into every page it runs on, letting any site detect that it's installed.

PorNo! Porn Blocker lets any web page save redirect URLs into its Chrome sync storage.

Prime Cinema mirrors its site cookies into browser sync storage and rewrites them as JavaScript-readable cookies.

Prime Video Picture In Picture [QVI] sends Prime Video profile, contact, viewing, subscription, and payment data to remote servers.

Print Notion stores your Notion access token in chrome.storage.sync instead of local storage, so it syncs across your Chrome devices.

ProBlocker sends YouTube watchtime request details to theproblocker.com when a remote beta mode is enabled.

ProfitTree lets scripts on Etsy search pages read whether you are signed in to the extension.

Programa Web Clipper lets any website drive its clipper iframe to send supplied page content to Programa.

Propbar identifies logged-in users to PostHog and sends property listing prices to Propbar for price history.

Protect Eye requests GeoIP data from geoplugin.net over HTTP during installation to set its location.

The extension exposes a native messaging bridge to any web page, allowing arbitrary JSON to be forwarded to a local host application.

QUITTR redirects blocked adult-site visits to a page that loads Google Fonts plus Apple and Wikimedia badge images.

Switch between recent browser tabs using keyboard shortcuts and a popup list.

Quizwiz lets any visited page command its content script to overwrite your clipboard text.

RPG Game - Dedalium by Loycom Games sends visited page URLs to the Dedalium API for page-specific actions.

Recon - FACEIT CS2 Predictor embeds a bearer API secret and sends it with FACEIT match IDs to recon-api.brkovic.dev.

Rewards Search Automator Old lets websites trigger its popup to redirect the active tab to Bing.

Roblox 2019 injects Roblox theme CSS that loads images from svgur.com and i.imgur.com on Roblox pages.

Rocketrip sends Concur employee identifiers and profile details to Mixpanel analytics.