Low risk browser extensions

Thống kê Sốp Pi bởi J2TEAM removes Shopee frame-protection headers for Shopee subframes.

Toolsy.io records sampled Sentry session replays on Etsy pages and sends replay data to Sentry.

Topaz SigIDExtLite relays page-supplied commands to a local fingerprint driver on any website without origin validation.

Torrent Search Engine For Chrome Professional sends Chromeapps search/navigation URLs and referrers to analytics.chromeapps.site.

Transcript YouTube reports React panel exceptions on YouTube pages to a Sentry project.

Translate sends user-selected text from any website to Google Translate when the translate icon is clicked.

Translator sends selected text and a stored generated email identifier to MyMemory for translation.

Turbo Sync sends users to a plaintext HTTP page to download the native messaging host installer, enabling network interception.

TwExportly captures X/Twitter GraphQL authorization headers and reuses them during user-triggered tweet exports.

Twitch Username and User ID Translator sends submitted conversion input to usernametouserid.spiffy.dev.

Ultimate UK Visa Sponsor Checker loads third-party donation images into job-site pages where it displays results.

Umbra Dark Mode copies cross-origin stylesheet text into page-readable style elements on every site.

Unfolks reports Instagram workflow errors to Sentry with the current page URL, referrer, and user-agent context.

Unielon has no dynamically confirmed privacy or security findings in this scanner.

UpDog - TikTok & Instagram Analytics sends the signed-in Instagram username to a Supabase endpoint.

V-DOCS for Chrome sends selected or auto-triggered page documents and request details to a local WebSocket client.

VK Blue injects a page script on vk.com that attempts to subscribe the signed-in user to the VK Blue group.

VetRec accepts external extension messages that can open caller-supplied URLs in new browser tabs.

Vi Subtitle sends the active tab hostname and a persistent client ID to Google Analytics when its popup opens.

Video Roll accepts sign-in messages from pages whose URL merely contains videoroll.app and stores the supplied user data.

Video Speed Controller runs on every site and periodically scrolls pages, sends mousemove events, and clicks matching buttons.

WA Number Checker posts a persistent anonymous extension identifier to ext.leadsext.com during startup.

WhatsApp Number Checker sends your WhatsApp account ID and phone number to its service and Aliyun logging.

WAWebSender sends WhatsApp account, contact, and group metadata from WhatsApp Web pages to Aliyun telemetry.

Wallchain X Score sends visited X pages and extension user context to Wallchain analytics.

Watch Movies Online sends new-tab search box input to watchmovieonline.net as you type.

Web for Google Messages inserts remote message HTML into Google pages before the first display is sanitized.

WhaScale sends WhatsApp Web account/session details and device ID to its backend during content initialization.

Woffu stores offline clock-in records in a client-side cookie encrypted with a key shipped in the extension.

World Clocks loads Google Fonts from its new-tab page, sending the page request to fonts.googleapis.com.

Xtab New Tab sends a persistent extension UUID and device metadata to Xtab during install and daily online checks.

Yshot Youtube Screenshot lets any page trigger its YouTube-frame screenshot action through an unchecked message bridge.

ZBD Browser Extension lets any webpage replace the stored ZBD API bearer token.

ZDialer - Zoho Voice Extension accepts page postMessage events that can answer or end Zoho Voice calls.

BestPrice.com sends the URL of every page you visit to its own server to check for a cashback offer.

demado stores a launched workflow ID and configuration in page sessionStorage that the opened site can read.

fontDownloader sends the active tab's URL and a browser fingerprint to an external server every time a script error occurs.

iFlux Mining Node sends browser and device fingerprint fields to gw.iflux.global when creating a mining node.

smrtPhone.io Chrome Dialer lets any webpage trigger its click-to-call path for a page-supplied phone number.

taba11y loads a Google Fonts stylesheet into the active page when you run an accessibility scan.

The extension injects a native messaging bridge to a Rutoken hardware PKI token into every web page, accessible to any page script.

VPN for Gemini routes Google and Telegram traffic through configured proxy servers.

רדיו לייב sends selected station details and playback events to Google Analytics.

クリックポスト拡張機能 sends Amazon OAuth token requests with a packaged client secret.

小結 sends open-tab URLs to Google Analytics when Chrome starts or the extension installs.

常用工具(ToolBox) loads remote stylesheet files from p1.chenapp.com when its popup opens.

快速bilibili下载助手 injects scripts into embedded Bilibili players and can start downloads from page messages.

智能bilibili下载助手工具 lets embedding pages trigger Bilibili metadata fetches and video downloads.

阿里云RPA connects to a local native host and executes arbitrary JavaScript in any browser tab using the Chrome debugger API.

이커머스 AI 솔루션 sends page-provided keyword queries to eaisolution.com through its lookup feature.

SimpleLogin exposes an unguarded postMessage handler on every page, letting any site script force navigation to the SimpleLogin dashboard.

Speed Dial 2 New tab page syncs bookmarks and per-site visit patterns to the vendor's server every two hours.

DF YouTube (Distraction Free) ships a hardcoded Mailgun API private key inside the extension package.

FoxClocks sends clicked statusbar clock details from extension storage to the current page window.

The extension opens a promotional tab on first install, sending the extension name and UI language to promo-newtab.club over HTTP.

Search and New Tab by Yahoo sends destination URLs and a persistent tracking token to geo.yahoo.com on every new-tab link click.

Swift Selection Search rewrites page Content-Security-Policy headers to allow inline styles on HTTP(S) pages.

Refined GitHub fetches version-specific CSS from refined-github.github.io and injects it into GitHub pages.

Tasks for Canvas™ sends the school's hostname to the developer's analytics server at most once every 30 days.

AI Speak Subtitles for YouTube lets any website set its account token, then sends that token to BlipCut account APIs.