Low risk browser extensions

AliExpress Image Search & Supplier Finder - Thieve lets websites read and change its synced settings.

Among Us Shimeji For Google Chrome loads Among Us sprite images from an Amazon S3 host on Google pages.

Auto Dialer for Twilio Platform sends the Chrome profile email and install ID to Google Analytics over HTTP.

Autolingo exposes its Chrome extension ID to Duolingo page scripts through a page event bridge.

BTS Cursor injects its extension ID into page-readable CSS on every website.

CDA Downloader randomly opens short.ovh advertising tabs when you click links or its download button on CDA pages.

CTERA Edit relays page-triggered CustomEvents to a native desktop application on all websites without origin validation.

CXone Agent Click-to-Dial turns phone numbers on any page into dial links and forwards clicked numbers to the CXone agent app.

Chandler sends its stored bearer token from all-site content scripts to an API host chosen by remote config.

Cisco Web Communicator bridges any web page to the Cisco Jabber native host using only the extension's public ID as a gate.

Click Image Download lets page-generated alt-click events trigger extension-managed image downloads.

Close Tab by Double Right Click injects all-page click handlers that let pages trigger tab closes.

CloudGate UNO for Google Chrome sends page URLs containing cgContextId to its configured CloudGate validation endpoint.

Comix Downloader sends a hashed ID of every comix.to profile you visit to its own server, with no opt-out.

Controls for Youtube accepts page messages for playback controls and can include stored usage stats in its uninstall survey.

Copilotly writes page-readable browser identifiers into storage on every matched website.

Cryplex AI Storage Node lets any website set its stored auth token and trigger node sync to app.cryplex.ai.

Daily Feast Recipe sends recipe API requests with an embedded API key to api.spoonacular.com.

DailyBibleHub includes a Spoonacular API key and sends recipe search requests from its new tab page to Spoonacular.

DailyFactTab sends new-tab fun fact requests to RapidAPI using a hardcoded API key.

DailyWorldAstrology embeds a Spoonacular API key in its new-tab recipe requests to api.spoonacular.com.

DealCloud forwards web page messages from its Gmail proxy into extension background actions.

Dextension sends Dext profile and account analytics identifiers to Segment.

Download YouTube Kids for PC, Mac And Windows uses a hardcoded default lock password and stores it locally.

Easy Mute for Google Meet sends Google Meet page URLs, titles, and a persistent user ID to Google Analytics.

Edit with Sublime Text exposes a web-accessible page any site can embed to write arbitrary content to disk and open it in Sublime Text.

Export Emails to Docs reads Gmail account-switcher email addresses and sends them to cloudHQ during Gmail initialization.

FluentAI accepts page messages that can trigger authenticated translation requests.

Free Medium Reader sends the current page URL to freedium-mirror.cfd when its reader overlay opens.

Fusion Narrate Extension relays CustomEvents from any web page to the Dolbey Narrate dictation app via native messaging.

GeePeeTee loads Font Awesome styling from cdnjs.cloudflare.com inside its extension pages.

Notebooklm Source Importer sends selected AI chat and document content to NotebookLM when you export it.

Gloc sends GitHub repository page telemetry to the developer's Umami endpoint.

Gmail Checker sends logged-in Gmail account addresses and browser telemetry to Alibaba Cloud Log Service.

Good Morning - New Tab by cloudHQ sends your Gmail address and account-switcher email list to cloudHQ on Gmail.

HAPPY ORDER injects a page script on shopping sites and disables Taobao anti-risk feature flags.

The extension sends report-issue submissions to Wireframeit with a secret embedded in its service worker.

Impact Factor Finder sends Google Scholar profile details and paper metadata to two Supabase backends.

InboxMailWorld's new-tab page sends recipe API requests to Spoonacular with a bundled API key.

InboxMailZone sends recipe lookup requests from its new-tab page to Spoonacular with a bundled API key.

Joxi runs hotkey listeners on every website and uses Joxi token requests for sign-in and refresh flows.

Lasso lets any web page trigger its injected bridge to open a supplied HTTP(S) URL in a new active tab.

Lessonly Recording exposes its installed status to every page through a DOM marker and window message.

Lionel Messi Wallpapers HD 4K loads notification HTML from api.gameograf.com into its new tab page.

MEGA Pass lets any website detect that the extension is installed through a content-script message probe.

Meet Compute System Recovery Utility sends recovery-target and removable-drive details to Google Analytics when telemetry is enabled.

Microsoft Bing Search & News sends Bing MUID cookie and device telemetry to g.ceipmsn.com over HTTP.

Netflix, Prime, JioCinema, Hotstar - Auto intro skipper sends skip actions and location details to Mixpanel.

ONTO Wallet forwards wallet RPC requests from page frames to the extension as the top-level site.

Owl devtools lets any webpage ask the extension to open its Owl documentation tab.

Password generator loads its popup font stylesheet from Google Fonts over HTTP.

QR Code Reader loads its popup stylesheets from cdnjs.cloudflare.com and cdn.jsdelivr.net when the popup opens.

RECEPTIONIST Chrome Extension adds installed extension names and versions to Sentry error-reporting context.

Rewards Auto Search reports high automated-search counts and a persistent extension token to its backend.

SADocumentExtension relays arbitrary CustomEvent payloads from any web page to the native host sa.document.extension with no filtering.

SIU Library collects search terms and subscribed e-resource browsing URLs for MyLOFT analytics.

Save Emails to Dropbox by cloudHQ sends Gmail account-switcher email addresses to cloudHQ during its pre-user check.

Seismic sends visited page URLs to integrations.knowledge.seismic.com when knowledge triggers are enabled.

Shopping Assistant sends shopping page details to joinsafedeal.com and checks visited domains with reputation services.