Low risk browser extensions

V-DOCS for Chrome sends selected or auto-triggered page documents and request details to a local WebSocket client.

VK Blue injects a page script on vk.com that attempts to subscribe the signed-in user to the VK Blue group.

Vi Subtitle sends the active tab hostname and a persistent client ID to Google Analytics when its popup opens.

Video Roll accepts sign-in messages from pages whose URL merely contains videoroll.app and stores the supplied user data.

Video Speed Controller runs on every site and periodically scrolls pages, sends mousemove events, and clicks matching buttons.

WA Number Checker posts a persistent anonymous extension identifier to ext.leadsext.com during startup.

WhatsApp Number Checker sends your WhatsApp account ID and phone number to its service and Aliyun logging.

WAWebSender sends WhatsApp account, contact, and group metadata from WhatsApp Web pages to Aliyun telemetry.

Wallchain X Score sends visited X pages and extension user context to Wallchain analytics.

Watch Movies Online sends new-tab search box input to watchmovieonline.net as you type.

Web for Google Messages inserts remote message HTML into Google pages before the first display is sanitized.

WhaScale sends WhatsApp Web account/session details and device ID to its backend during content initialization.

Woffu stores offline clock-in records in a client-side cookie encrypted with a key shipped in the extension.

World Clocks loads Google Fonts from its new-tab page, sending the page request to fonts.googleapis.com.

Xtab New Tab sends a persistent extension UUID and device metadata to Xtab during install and daily online checks.

Yshot Youtube Screenshot lets any page trigger its YouTube-frame screenshot action through an unchecked message bridge.

ZBD Browser Extension lets any webpage replace the stored ZBD API bearer token.

BestPrice.com sends the URL of every page you visit to its own server to check for a cashback offer.

demado stores a launched workflow ID and configuration in page sessionStorage that the opened site can read.

fontDownloader sends the active tab's URL and a browser fingerprint to an external server every time a script error occurs.

iFlux Mining Node sends browser and device fingerprint fields to gw.iflux.global when creating a mining node.

smrtPhone.io Chrome Dialer lets any webpage trigger its click-to-call path for a page-supplied phone number.

taba11y loads a Google Fonts stylesheet into the active page when you run an accessibility scan.

The extension injects a native messaging bridge to a Rutoken hardware PKI token into every web page, accessible to any page script.

VPN for Gemini routes Google and Telegram traffic through configured proxy servers.

רדיו לייב sends selected station details and playback events to Google Analytics.

クリックポスト拡張機能 sends Amazon OAuth token requests with a packaged client secret.

小結 sends open-tab URLs to Google Analytics when Chrome starts or the extension installs.

常用工具(ToolBox) loads remote stylesheet files from p1.chenapp.com when its popup opens.

快速bilibili下载助手 injects scripts into embedded Bilibili players and can start downloads from page messages.

智能bilibili下载助手工具 lets embedding pages trigger Bilibili metadata fetches and video downloads.

阿里云RPA connects to a local native host and executes arbitrary JavaScript in any browser tab using the Chrome debugger API.

이커머스 AI 솔루션 sends page-provided keyword queries to eaisolution.com through its lookup feature.

DF YouTube (Distraction Free) ships a hardcoded Mailgun API private key inside the extension package.

Video Converter World replaces the browser's default search engine with a Yahoo affiliate URL that embeds tracking parameters in every query.

Censor Tracker fetches its proxy server configuration from a remote GitHub URL and routes all browser traffic through that server.

FoxClocks sends clicked statusbar clock details from extension storage to the current page window.

Swift Selection Search rewrites page Content-Security-Policy headers to allow inline styles on HTTP(S) pages.

The extension opens a promotional tab on first install, sending the extension name and UI language to promo-newtab.club over HTTP.

Refined GitHub fetches version-specific CSS from refined-github.github.io and injects it into GitHub pages.

Search and New Tab by Yahoo sends destination URLs and a persistent tracking token to geo.yahoo.com on every new-tab link click.

AI Speak Subtitles for YouTube lets any website set its account token, then sends that token to BlipCut account APIs.

AliExpress Image Search & Supplier Finder - Thieve lets websites read and change its synced settings.

Among Us Shimeji For Google Chrome loads Among Us sprite images from an Amazon S3 host on Google pages.

AudioContext Fingerprint Defender can show fingerprint alerts based on messages from webpages.

Auto Dialer for Twilio Platform sends the Chrome profile email and install ID to Google Analytics over HTTP.

Autolingo exposes its Chrome extension ID to Duolingo page scripts through a page event bridge.

BTS Cursor injects its extension ID into page-readable CSS on every website.

CDA Downloader randomly opens short.ovh advertising tabs when you click links or its download button on CDA pages.

CTERA Edit relays page-triggered CustomEvents to a native desktop application on all websites without origin validation.

CXone Agent Click-to-Dial turns phone numbers on any page into dial links and forwards clicked numbers to the CXone agent app.

Chandler sends its stored bearer token from all-site content scripts to an API host chosen by remote config.

Cisco Web Communicator bridges any web page to the Cisco Jabber native host using only the extension's public ID as a gate.

Clarity Tab sends recent bookmark domains to Google's favicon service on its new tab page.

Close Tab by Double Right Click injects all-page click handlers that let pages trigger tab closes.

CloudGate UNO for Google Chrome sends page URLs containing cgContextId to its configured CloudGate validation endpoint.

Comix Downloader sends a hashed ID of every comix.to profile you visit to its own server, with no opt-out.

Controls for Youtube accepts page messages for playback controls and can include stored usage stats in its uninstall survey.

Copilotly writes page-readable browser identifiers into storage on every matched website.

Daily Feast Recipe sends recipe API requests with an embedded API key to api.spoonacular.com.