Low risk browser extensions

Temp Mail - Disposable Temporary Email adds the active tab hostname to its uninstall analytics URL.

Templates for Google Docs by cloudHQ sends Google account emails from Docs and Drive to cloudHQ during pre-user checks.

TestGen Plug-In proxies credentialed browser requests to arbitrary URLs—including internal network hosts—through a native host application.

Text Request includes a Google OAuth client secret in its public extension JavaScript.

Thales Smart Card Bridge relays smart card commands from any website to a native host via an unguarded CustomEvent channel.

Quick QR Code accepts QR-history entries from any page script with no origin check and can jump to attacker-set URLs.

The RSS Aggregator lets any website trigger extension-privileged requests to caller-supplied URLs.

Themefy sends each bookmarked URL to Google's favicon service when opening its new tab page.

Topaz SigIDExtLite relays page-supplied commands to a local fingerprint driver on any website without origin validation.

Torrent Search Engine For Chrome Professional sends Chromeapps search/navigation URLs and referrers to analytics.chromeapps.site.

Transcript YouTube reports React panel exceptions on YouTube pages to a Sentry project.

Translator sends selected text and a stored generated email identifier to MyMemory for translation.

Turbo Sync sends users to a plaintext HTTP page to download the native messaging host installer, enabling network interception.

TwExportly captures X/Twitter GraphQL authorization headers and reuses them during user-triggered tweet exports.

Twitch Username and User ID Translator sends submitted conversion input to usernametouserid.spiffy.dev.

Ultimate UK Visa Sponsor Checker loads third-party donation images into job-site pages where it displays results.

Umbra Dark Mode copies cross-origin stylesheet text into page-readable style elements on every site.

Unielon has no dynamically confirmed privacy or security findings in this scanner.

UpDog - TikTok & Instagram Analytics sends the signed-in Instagram username to a Supabase endpoint.

VK Blue injects a page script on vk.com that attempts to subscribe the signed-in user to the VK Blue group.

VWO (Wingify) lets websites trigger loading account-specific VWO SmartCode into the page.

The extension lets webpages trigger a preview that strips frame-blocking headers and frames page-chosen URLs.

Vi Subtitle sends the active tab hostname and a persistent client ID to Google Analytics when its popup opens.

Video Roll accepts sign-in messages from pages whose URL merely contains videoroll.app and stores the supplied user data.

Video Speed Controller runs on every site and periodically scrolls pages, sends mousemove events, and clicks matching buttons.

WA Number Checker posts a persistent anonymous extension identifier to ext.leadsext.com during startup.

WhatsApp Number Checker sends your WhatsApp account ID and phone number to its service and Aliyun logging.

WAWebSender sends WhatsApp account, contact, and group metadata from WhatsApp Web pages to Aliyun telemetry.

Wallchain X Score sends visited X pages and extension user context to Wallchain analytics.

Watch Movies Online sends new-tab search box input to watchmovieonline.net as you type.

Web for Google Messages inserts remote message HTML into Google pages before the first display is sanitized.

WhaScale sends WhatsApp Web account/session details and device ID to its backend during content initialization.

Woffu stores offline clock-in records in a client-side cookie encrypted with a key shipped in the extension.

World Clocks loads Google Fonts from its new-tab page, sending the page request to fonts.googleapis.com.

XML Formatter sends text you select on a page to linangdata.com when you use its context-menu formatter.

Xtab New Tab sends a persistent extension UUID and device metadata to Xtab during install and daily online checks.

Yshot Youtube Screenshot lets any page trigger its YouTube-frame screenshot action through an unchecked message bridge.

ZBD Browser Extension lets any webpage replace the stored ZBD API bearer token.

ZDialer - Zoho Voice Extension accepts page postMessage events that can answer or end Zoho Voice calls.

BestPrice.com sends the URL of every page you visit to its own server to check for a cashback offer.

demado stores a launched workflow ID and configuration in page sessionStorage that the opened site can read.

fontDownloader sends the active tab's URL and a browser fingerprint to an external server every time a script error occurs.

iFlux Mining Node sends browser and device fingerprint fields to gw.iflux.global when creating a mining node.

smrtPhone.io Chrome Dialer lets any webpage trigger its click-to-call path for a page-supplied phone number.

taba11y loads a Google Fonts stylesheet into the active page when you run an accessibility scan.

The extension injects a native messaging bridge to a Rutoken hardware PKI token into every web page, accessible to any page script.

רדיו לייב sends selected station details and playback events to Google Analytics.

クリックポスト拡張機能 sends Amazon OAuth token requests with a packaged client secret.

小結 sends open-tab URLs to Google Analytics when Chrome starts or the extension installs.

快速bilibili下载助手 injects scripts into embedded Bilibili players and can start downloads from page messages.

智能bilibili下载助手工具 lets embedding pages trigger Bilibili metadata fetches and video downloads.

阿里云RPA connects to a local native host and executes arbitrary JavaScript in any browser tab using the Chrome debugger API.

DF YouTube (Distraction Free) ships a hardcoded Mailgun API private key inside the extension package.

Censor Tracker fetches its proxy server configuration from a remote GitHub URL and routes all browser traffic through that server.

FoxClocks sends clicked statusbar clock details from extension storage to the current page window.

Swift Selection Search rewrites page Content-Security-Policy headers to allow inline styles on HTTP(S) pages.

Video Converter World replaces the browser's default search engine with a Yahoo affiliate URL that embeds tracking parameters in every query.

Search and New Tab by Yahoo sends destination URLs and a persistent tracking token to geo.yahoo.com on every new-tab link click.

Refined GitHub fetches version-specific CSS from refined-github.github.io and injects it into GitHub pages.

The extension opens a promotional tab on first install, sending the extension name and UI language to promo-newtab.club over HTTP.