Low risk browser extensions

SET-RN Security Module relays caller-supplied URLs to a locally installed native host app without URL validation.

SHOWROOM すこすこツール＋ writes its runtime ID into SHOWROOM page storage where site scripts can read it.

SOOP(아프리카TV) 채팅매니저 loads remote setup markup from mngr.flabs.kr into scoped SOOP and AfreecaTV pages.

SPM File Edit relays postMessage commands from any page to a local native messaging host with no origin validation.

STUDY4 lets webpages trigger extension-privileged dictionary lookups to its configured dictionary providers.

SYF Apty Client loads Apty JavaScript into SYF Coupa pages and sends page activity to Apty when analytics are enabled.

Satoru Gojo: Jujutsu Sorcerer Live Wallpaper loads Gameograf API HTML and shortcuts into its new-tab page.

Savewise includes hardcoded bearer tokens for its own offer lookup, card-offer, and logging APIs.

ScreenCatch removes CSP and X-Frame-Options headers from main-frame and sub-frame pages while you browse.

Screenshot & Screen Recorder w/ Webcam-Droplr lets any website message it to pause recording or remove Droplr controls.

Segura MySafe injects a Font Awesome script from kit.fontawesome.com into every HTTP and HTTPS page.

Sendblue Call lets any webpage open attacker-chosen tabs through its injected event bridge.

Sendspark Video and Screen Recorder writes account profile details into matching /share/ pages' local storage.

Shop Blue Assistant sends UI interaction telemetry to Google Analytics keyed by the user's AirMiles/BlueRewards collector number.

Shop TODAY Savings sends Shopify checkout events and shopping-page product details to todayshow.app.

Shop for a Cause accepts checkout page messages that can write caller-supplied credit-card details into payment fields.

ShopifyHunt embeds a Creem payment API key in its background script for checkout and subscription requests.

SideAI sends user-selected page text, full-page visible text, and page URLs into ChatGPT.

Skip ads and intros, works with Disney Plus [QVI] collects Disney+ profile, subscription, and viewing data for remote uploads.

Smart Share From eBay adds an overlay iframe whose DOM id includes the extension's runtime ID.

SnapTrans Translate sends selected page text to Google Translate when its translator icon is clicked.

Snek Tab sends new-tab search queries to ext.snektab.com and saved shortcut URLs to Google's favicon service.

Snippet Highlighter accepts webpage messages that can create, edit, or delete signed-in snippets on gosnippet.com.

Somaiya E-Library reads the search terms you type on other websites and reports them to its vendor's backend.

Speed Dial New Tab sends the hostname of every bookmark tile shown on its dashboard to third-party favicone.com to fetch favicons.

Steam Workshop Downloader rewrites the Steam subscribe button to open a cleartext steamworkshop.download URL.

Stencil sends the current page URL to its getstencil.com iframe when the app opens.

StudyBuddy - Homework Solver posts its extension runtime ID into every page it runs on.

Suggestion Shield sends address-bar search terms and suggestion prefixes to suggestionshield.com endpoints.

Surfer for Google Docs and ChatGPT removes ChatGPT's Content-Security-Policy header on main-page loads.

Tab Colorizer Free loads replacement favicons from placehold.co on pages where you trigger tab colorization.

Table Detection & Extraction sends selected table contents from visited pages to TableConvert for conversion.

Table Tennis sends popup page views and a persistent client ID to Google Analytics.

Tali AI removes browser security policy headers from main-frame pages on several EHR domains.

Tapit reports handled errors on Faceit and Steam pages to Sentry with the current page URL and browser user agent.

Telegram Video Downloader sends install/update telemetry, public IP, and the active Telegram tab URL to an Aliyun logstore.

Temp Mail - Disposable Temporary Email adds the active tab hostname to its uninstall analytics URL.

Templates for Google Docs by cloudHQ sends Google account emails from Docs and Drive to cloudHQ during pre-user checks.

TestGen Plug-In proxies credentialed browser requests to arbitrary URLs—including internal network hosts—through a native host application.

Text Request includes a Google OAuth client secret in its public extension JavaScript.

Thales Smart Card Bridge relays smart card commands from any website to a native host via an unguarded CustomEvent channel.

The Jukebox sends a popup-open ping to a Supabase endpoint.

Quick QR Code accepts QR-history entries from any page script with no origin check and can jump to attacker-set URLs.

The RSS Aggregator lets any website trigger extension-privileged requests to caller-supplied URLs.

Themefy sends each bookmarked URL to Google's favicon service when opening its new tab page.

Thống kê Sốp Pi bởi J2TEAM removes Shopee frame-protection headers for Shopee subframes.

TopCash lets any webpage ask the extension to open an attacker-chosen URL in a new tab.

Topaz SigIDExtLite relays page-supplied commands to a local fingerprint driver on any website without origin validation.

Torrent Search Engine For Chrome Professional sends Chromeapps search/navigation URLs and referrers to analytics.chromeapps.site.

Transcript YouTube reports React panel exceptions on YouTube pages to a Sentry project.

Translate sends user-selected text from any website to Google Translate when the translate icon is clicked.

Translator sends selected text and a stored generated email identifier to MyMemory for translation.

Turbo Sync sends users to a plaintext HTTP page to download the native messaging host installer, enabling network interception.

TwExportly captures X/Twitter GraphQL authorization headers and reuses them during user-triggered tweet exports.

Twitch Username and User ID Translator sends submitted conversion input to usernametouserid.spiffy.dev.

Ultimate UK Visa Sponsor Checker loads third-party donation images into job-site pages where it displays results.

Umbra Dark Mode copies cross-origin stylesheet text into page-readable style elements on every site.

Unfolks reports Instagram workflow errors to Sentry with the current page URL, referrer, and user-agent context.

Unielon has no dynamically confirmed privacy or security findings in this scanner.

UpDog - TikTok & Instagram Analytics sends the signed-in Instagram username to a Supabase endpoint.