Low risk browser extensions

ProBlocker sends YouTube watchtime request details to theproblocker.com when a remote beta mode is enabled.

ProfitTree lets scripts on Etsy search pages read whether you are signed in to the extension.

Programa Web Clipper lets any website drive its clipper iframe to send supplied page content to Programa.

Propbar identifies logged-in users to PostHog and sends property listing prices to Propbar for price history.

Protect Eye requests GeoIP data from geoplugin.net over HTTP during installation to set its location.

The extension exposes a native messaging bridge to any web page, allowing arbitrary JSON to be forwarded to a local host application.

QUITTR redirects blocked adult-site visits to a page that loads Google Fonts plus Apple and Wikimedia badge images.

Switch between recent browser tabs using keyboard shortcuts and a popup list.

Quizwiz lets any visited page command its content script to overwrite your clipboard text.

RPG Game - Dedalium by Loycom Games sends visited page URLs to the Dedalium API for page-specific actions.

ReYohoho Twitch Extension sends your Twitch ID and watched channel to its backend for its friends feature.

Recon - FACEIT CS2 Predictor embeds a bearer API secret and sends it with FACEIT match IDs to recon-api.brkovic.dev.

Rewards Search Automator Old lets websites trigger its popup to redirect the active tab to Bing.

Roblox 2019 injects Roblox theme CSS that loads images from svgur.com and i.imgur.com on Roblox pages.

Rocketrip sends Concur employee identifiers and profile details to Mixpanel analytics.

SET-RN Security Module relays caller-supplied URLs to a locally installed native host app without URL validation.

SHOWROOM すこすこツール＋ writes its runtime ID into SHOWROOM page storage where site scripts can read it.

SOOP(아프리카TV) 채팅매니저 loads remote setup markup from mngr.flabs.kr into scoped SOOP and AfreecaTV pages.

SPM File Edit relays postMessage commands from any page to a local native messaging host with no origin validation.

STUDY4 lets webpages trigger extension-privileged dictionary lookups to its configured dictionary providers.

SYF Apty Client loads Apty JavaScript into SYF Coupa pages and sends page activity to Apty when analytics are enabled.

Satoru Gojo: Jujutsu Sorcerer Live Wallpaper loads Gameograf API HTML and shortcuts into its new-tab page.

Savewise includes hardcoded bearer tokens for its own offer lookup, card-offer, and logging APIs.

ScreenCatch removes CSP and X-Frame-Options headers from main-frame and sub-frame pages while you browse.

Screenshot & Screen Recorder w/ Webcam-Droplr lets any website message it to pause recording or remove Droplr controls.

Segura MySafe injects a Font Awesome script from kit.fontawesome.com into every HTTP and HTTPS page.

Sendblue Call lets any webpage open attacker-chosen tabs through its injected event bridge.

Sendspark Video and Screen Recorder writes account profile details into matching /share/ pages' local storage.

Shop Blue Assistant sends UI interaction telemetry to Google Analytics keyed by the user's AirMiles/BlueRewards collector number.

Shop TODAY Savings sends Shopify checkout events and shopping-page product details to todayshow.app.

Shop for a Cause accepts checkout page messages that can write caller-supplied credit-card details into payment fields.

ShopifyHunt embeds a Creem payment API key in its background script for checkout and subscription requests.

Skip ads and intros, works with Disney Plus [QVI] collects Disney+ profile, subscription, and viewing data for remote uploads.

Smart Share From eBay adds an overlay iframe whose DOM id includes the extension's runtime ID.

SnapTrans Translate sends selected page text to Google Translate when its translator icon is clicked.

Snek Tab sends new-tab search queries to ext.snektab.com and saved shortcut URLs to Google's favicon service.

Snippet Highlighter accepts webpage messages that can create, edit, or delete signed-in snippets on gosnippet.com.

Somaiya E-Library reads the search terms you type on other websites and reports them to its vendor's backend.

Speed Dial New Tab sends the hostname of every bookmark tile shown on its dashboard to third-party favicone.com to fetch favicons.

Steam Workshop Downloader rewrites the Steam subscribe button to open a cleartext steamworkshop.download URL.

Stencil sends the current page URL to its getstencil.com iframe when the app opens.

Twitch Stats by Streams Charts embeds a signing secret used for its StreamsCharts API authorization tokens.

StudyBuddy - Homework Solver posts its extension runtime ID into every page it runs on.

Suggestion Shield sends address-bar search terms and suggestion prefixes to suggestionshield.com endpoints.

Surfer for Google Docs and ChatGPT removes ChatGPT's Content-Security-Policy header on main-page loads.

Tab Colorizer Free loads replacement favicons from placehold.co on pages where you trigger tab colorization.

Table Detection & Extraction sends selected table contents from visited pages to TableConvert for conversion.

Table Tennis sends popup page views and a persistent client ID to Google Analytics.

Tali AI removes browser security policy headers from main-frame pages on several EHR domains.

Tapit reports handled errors on Faceit and Steam pages to Sentry with the current page URL and browser user agent.

Telegram Video Downloader sends install/update telemetry, public IP, and the active Telegram tab URL to an Aliyun logstore.

Temp Mail - Disposable Temporary Email adds the active tab hostname to its uninstall analytics URL.

Templates for Google Docs by cloudHQ sends Google account emails from Docs and Drive to cloudHQ during pre-user checks.

TestGen Plug-In proxies credentialed browser requests to arbitrary URLs—including internal network hosts—through a native host application.

Text Request includes a Google OAuth client secret in its public extension JavaScript.

Thales Smart Card Bridge relays smart card commands from any website to a native host via an unguarded CustomEvent channel.

The Jukebox sends a popup-open ping to a Supabase endpoint.

Quick QR Code accepts QR-history entries from any page script with no origin check and can jump to attacker-set URLs.

The RSS Aggregator lets any website trigger extension-privileged requests to caller-supplied URLs.

Themefy sends each bookmarked URL to Google's favicon service when opening its new tab page.