Low risk browser extensions

Volume Booster requests Google Fonts when its popup opens, sharing connection metadata with Google.

AI Speak Subtitles for YouTube lets any website set its account token, then sends that token to BlipCut account APIs.

AiPrice Search by Image for Lazada lets Lazada page scripts trigger image uploads to api.aiprice.com.

AliExpress Image Search & Supplier Finder - Thieve lets websites read and change its synced settings.

Among Us Shimeji For Google Chrome loads Among Us sprite images from an Amazon S3 host on Google pages.

AudioContext Fingerprint Defender can show fingerprint alerts based on messages from webpages.

Auto Dialer for Twilio Platform sends the Chrome profile email and install ID to Google Analytics over HTTP.

Autolingo exposes its Chrome extension ID to Duolingo page scripts through a page event bridge.

BTS Cursor injects its extension ID into page-readable CSS on every website.

CDA Downloader randomly opens short.ovh advertising tabs when you click links or its download button on CDA pages.

CFCA CertEnrollment.LNWL Extension exposes an unguarded externally_connectable bridge that lets any webpage connect to and send arbitrary messages to native hosts on the user's system.

CTERA Edit relays page-triggered CustomEvents to a native desktop application on all websites without origin validation.

CXone Agent Click-to-Dial turns phone numbers on any page into dial links and forwards clicked numbers to the CXone agent app.

Canned Responses Pro for Jira starts LogRocket session replay on Jira pages and sends Atlassian account and license metadata.

Chandler sends its stored bearer token from all-site content scripts to an API host chosen by remote config.

Cisco Web Communicator bridges any web page to the Cisco Jabber native host using only the extension's public ID as a gate.

Clarity Tab sends recent bookmark domains to Google's favicon service on its new tab page.

Close Tab by Double Right Click injects all-page click handlers that let pages trigger tab closes.

CloudGate UNO for Google Chrome sends page URLs containing cgContextId to its configured CloudGate validation endpoint.

Controls for Youtube accepts page messages for playback controls and can include stored usage stats in its uninstall survey.

Copilotly writes page-readable browser identifiers into storage on every matched website.

Daily Feast Recipe sends recipe API requests with an embedded API key to api.spoonacular.com.

DailyBibleHub includes a Spoonacular API key and sends recipe search requests from its new tab page to Spoonacular.

DailyFactTab sends new-tab fun fact requests to RapidAPI using a hardcoded API key.

DailyWorldAstrology embeds a Spoonacular API key in its new-tab recipe requests to api.spoonacular.com.

DealCloud forwards web page messages from its Gmail proxy into extension background actions.

Dextension sends Dext profile and account analytics identifiers to Segment.

Download YouTube Kids for PC, Mac And Windows uses a hardcoded default lock password and stores it locally.

ESMART Token Web Plugin exposes a PKCS#11 hardware-token API to any webpage via an unauthenticated postMessage bridge injected on all sites.

Easy Mute for Google Meet sends Google Meet page URLs, titles, and a persistent user ID to Google Analytics.

Edit with Sublime Text exposes a web-accessible page any site can embed to write arbitrary content to disk and open it in Sublime Text.

Export Emails to Docs reads Gmail account-switcher email addresses and sends them to cloudHQ during Gmail initialization.

Extrator de token Discord captures Discord account tokens from browser requests, localStorage, and Discord page modules.

FluentAI accepts page messages that can trigger authenticated translation requests.

Free Medium Reader sends the current page URL to freedium-mirror.cfd when its reader overlay opens.

Free VPN Chrome extension - VPN Proxy Streamix sends a persistent install ID, device profile, and country to Streamix and Google Analytics.

Fusion Narrate Extension relays CustomEvents from any web page to the Dolbey Narrate dictation app via native messaging.

GeePeeTee loads Font Awesome styling from cdnjs.cloudflare.com inside its extension pages.

Notebooklm Source Importer sends selected AI chat and document content to NotebookLM when you export it.

Gloc sends GitHub repository page telemetry to the developer's Umami endpoint.

Gmail Checker sends logged-in Gmail account addresses and browser telemetry to Alibaba Cloud Log Service.

HAPPY ORDER injects a page script on shopping sites and disables Taobao anti-risk feature flags.

The extension sends report-issue submissions to Wireframeit with a secret embedded in its service worker.

Hunter Spy stores Shopee product and search details in page localStorage and hidden DOM markers.

Impact Factor Finder sends Google Scholar profile details and paper metadata to two Supabase backends.

InboxMailWorld's new-tab page sends recipe API requests to Spoonacular with a bundled API key.

InboxMailZone sends recipe lookup requests from its new-tab page to Spoonacular with a bundled API key.

Joxi runs hotkey listeners on every website and uses Joxi token requests for sign-in and refresh flows.

Lasso lets any web page trigger its injected bridge to open a supplied HTTP(S) URL in a new active tab.

Lessonly Recording exposes its installed status to every page through a DOM marker and window message.

Lootup Deal Finder bundles OAuth credentials and sends visited shopping domains to Kindred's API.

MEGA Pass lets any website detect that the extension is installed through a content-script message probe.

Meet Compute System Recovery Utility sends recovery-target and removable-drive details to Google Analytics when telemetry is enabled.

Microsoft Bing Search & News sends Bing MUID cookie and device telemetry to g.ceipmsn.com over HTTP.

MyWallPaper fetches the user's public IP address from ident.me over cleartext HTTP on the new tab page.

NCOverlay lets any website read and change its local extension storage through a page-message bridge.

Netflix, Prime, JioCinema, Hotstar - Auto intro skipper sends skip actions and location details to Mixpanel.

ONTO Wallet forwards wallet RPC requests from page frames to the extension as the top-level site.

Owl devtools lets any webpage ask the extension to open its Owl documentation tab.

Password generator loads its popup font stylesheet from Google Fonts over HTTP.