Low risk browser extensions

Password Boss reads form field values on all web pages and forwards them to the local Password Boss desktop app via native messaging.

Photo Zoom fetches server-supplied scripts and evaluates them in its all-sites content script.

Pieces for Developers lets any website request stored Pieces identifiers and site history state through a page message bridge.

Pinbox checks active tab URLs with withpinbox.com and sends saved pages, selected text, and images to its API.

Pinterest Pin Stats - Sort Pins validates saved license keys with InsightPins.

Plerdy SEO Analyzer accepts page messages that can replace its stored Plerdy token and send SEO audit data to Plerdy.

Popup Blocker injects a hidden, id-tagged element into every page it runs on, letting any site detect that it's installed.

PorNo! Porn Blocker lets any web page save redirect URLs into its Chrome sync storage.

Prime Cinema mirrors its site cookies into browser sync storage and rewrites them as JavaScript-readable cookies.

Prime Video Picture In Picture [QVI] sends Prime Video profile, contact, viewing, subscription, and payment data to remote servers.

ProBlocker sends YouTube watchtime request details to theproblocker.com when a remote beta mode is enabled.

ProfitTree lets scripts on Etsy search pages read whether you are signed in to the extension.

Programa Web Clipper lets any website drive its clipper iframe to send supplied page content to Programa.

Propbar identifies logged-in users to PostHog and sends property listing prices to Propbar for price history.

Protect Eye requests GeoIP data from geoplugin.net over HTTP during installation to set its location.

The extension exposes a native messaging bridge to any web page, allowing arbitrary JSON to be forwarded to a local host application.

QUITTR redirects blocked adult-site visits to a page that loads Google Fonts plus Apple and Wikimedia badge images.

Switch between recent browser tabs using keyboard shortcuts and a popup list.

Quizwiz lets any visited page command its content script to overwrite your clipboard text.

RPG Game - Dedalium by Loycom Games sends visited page URLs to the Dedalium API for page-specific actions.

Recon - FACEIT CS2 Predictor embeds a bearer API secret and sends it with FACEIT match IDs to recon-api.brkovic.dev.

Reddit Comment Scraper uploads saved scrape history, including comment data and Reddit thread URLs, to Supabase.

Rewards Search Automator Old lets websites trigger its popup to redirect the active tab to Bing.

Roblox 2019 injects Roblox theme CSS that loads images from svgur.com and i.imgur.com on Roblox pages.

Roblox Friend Manager shows a review prompt on non-Roblox pages after enough extension use.

Rocketrip sends Concur employee identifiers and profile details to Mixpanel analytics.

SET-RN Security Module relays caller-supplied URLs to a locally installed native host app without URL validation.

SHOWROOM すこすこツール＋ writes its runtime ID into SHOWROOM page storage where site scripts can read it.

SOOP(아프리카TV) 채팅매니저 loads remote setup markup from mngr.flabs.kr into scoped SOOP and AfreecaTV pages.

STUDY4 lets webpages trigger extension-privileged dictionary lookups to its configured dictionary providers.

SYF Apty Client loads Apty JavaScript into SYF Coupa pages and sends page activity to Apty when analytics are enabled.

Savewise includes hardcoded bearer tokens for its own offer lookup, card-offer, and logging APIs.

ScreenCatch removes CSP and X-Frame-Options headers from main-frame and sub-frame pages while you browse.

Screenshot & Screen Recorder w/ Webcam-Droplr lets any website message it to pause recording or remove Droplr controls.

Screenshot with URL - Full Page Screenshot captures page screenshots, URL/title details, optional logs, and local screen recordings.

Segura MySafe injects a Font Awesome script from kit.fontawesome.com into every HTTP and HTTPS page.

Sendspark Video and Screen Recorder writes account profile details into matching /share/ pages' local storage.

Shop Blue Assistant sends UI interaction telemetry to Google Analytics keyed by the user's AirMiles/BlueRewards collector number.

Shop TODAY Savings sends Shopify checkout events and shopping-page product details to todayshow.app.

Shop for a Cause accepts checkout page messages that can write caller-supplied credit-card details into payment fields.

ShopifyHunt embeds a Creem payment API key in its background script for checkout and subscription requests.

SideAI sends user-selected page text, full-page visible text, and page URLs into ChatGPT.

Signitic sends Gmail compose recipient addresses to hub.signitic.com when contact-list banners are enabled.

Skip ads and intros, works with Disney Plus [QVI] collects Disney+ profile, subscription, and viewing data for remote uploads.

Smart Share From eBay adds an overlay iframe whose DOM id includes the extension's runtime ID.

SnapTrans Translate sends selected page text to Google Translate when its translator icon is clicked.

Snippet Highlighter accepts webpage messages that can create, edit, or delete signed-in snippets on gosnippet.com.

Somaiya E-Library reads the search terms you type on other websites and reports them to its vendor's backend.

Steam Workshop Downloader rewrites the Steam subscribe button to open a cleartext steamworkshop.download URL.

Stencil sends the current page URL to its getstencil.com iframe when the app opens.

StudyBuddy - Homework Solver posts its extension runtime ID into every page it runs on.

Suggestion Shield sends address-bar search terms and suggestion prefixes to suggestionshield.com endpoints.

Surfer for Google Docs and ChatGPT removes ChatGPT's Content-Security-Policy header on main-page loads.

Swiftin lets any embedding parent page trigger translation of a child frame, sending page text and title to api.swiftin.dev.

Tab Colorizer Free loads replacement favicons from placehold.co on pages where you trigger tab colorization.

Table Capture captures the visible tab and uploads cropped screenshots through Imgkits before opening Livepolls.

Table Detection & Extraction sends selected table contents from visited pages to TableConvert for conversion.

Table Tennis sends popup page views and a persistent client ID to Google Analytics.

Tali AI removes browser security policy headers from main-frame pages on several EHR domains.

Telegram Video Downloader sends install/update telemetry, public IP, and the active Telegram tab URL to an Aliyun logstore.