Low risk browser extensions

SquarespaceWebsites Tools PRO lets allowed Squarespace and Squarewebsites pages read cached site export data.

Star Wars Weather sends visited-site hostnames to Google and precise location to OpenWeather for new-tab features.

Stash lets localhost:3000 pages read open tabs, bookmarks, and stored Stash data through its message bridge.

Strongbox AutoFill accepts postMessage commands from any web origin to fill credentials into forms or open new browser tabs.

Tab Wheel Scroll listens for wheel gestures on pages and switches the active tab when matching events occur.

Turbo.net Extension forwards every browser navigation URL to a locally installed Turbo.net sandman process via WebSocket.

UBC Workday Side by Side Calendar copies MyWorkday cookies into browser request header rules.

UiPath downloads and executes JavaScript code supplied by a local native host in both its background page and every web page visited.

Vocal reports some API errors to Sentry with request options that can include Authorization bearer headers.

Website Translator sends selected page text to Google Translate and opens whole-page translations with the current URL.

Yandex.Music Extension exposes its Chrome runtime ID to Yandex Music pages through a DOM attribute.

YogaPoseTutorial embeds a Spoonacular API key in its new-tab recipe helper.

YouTube Deleted Videos: Track and Restore stores playlist backups in YouTube page localStorage.

YourAIScroll sends account email addresses to www.youraiscroll.com to check subscription status.

shikicinema exposes hardcoded Kodik, Shikimori, and Smarthard API credentials in a web-accessible bundle.

wildberries track & history stores Wildberries bearer-style site tokens in Chrome sync storage.

The extension sends selected page text to games.onlinetechbd.com when its context-menu search is used.

Adaware AdBlock sends install, update, and daily browser environment telemetry to flow.lavasoft.com.

PrimeCinema creates a persistent tracking cookie and sends it to its website during installation.

Chameleon contacts a GeoIP service when IP-based language or timezone spoofing is enabled.

Torrent Control lets any web page send a magnet URI to the user's configured BitTorrent client.

AI Translation accepts page messages in its translation panel and sends text, page URLs, context, and extension IDs to its API.

Ad Skipper for Pluto TV [QVI] sends Pluto account, profile, bookmark, and continue-watching data to metricmuse.xyz.

Amazon Ad Tag Helper helps advertisers debug Amazon Ad Tag events and attributes on websites.

Audio Booster for Netflix [QVI] collects streaming profiles and viewing history and uploads results to me3x.online.

Automation Anywhere bridges browser activity to a locally installed RPA agent and forwards external web page messages to native host 'aa.browser.shim' without payload validation.

BBB Vote Counter automatically clicks Globo vote-again buttons after successful vote submissions.

BBViewer lets any page trigger a hidden liquid8d.dev iframe that receives the current page URL.

Blooket Hacker stores matched quiz question and answer text from active pages in Chrome Sync storage.

CloudTalk Click-to-Call lets webpages trigger its inserted phone links to send click-to-call requests to CloudTalk.

Cluing reports page URLs, titles, and reading engagement metrics for visible text blocks to account.cluing.io.

Codes Hunter sends Roblox game activity, copied codes, searches, and a persistent client ID to Google Analytics.

Contador de Seguidores sends selected Instagram account details to Invertexto endpoints.

Dark Mode lets any page trigger extension-powered fetches for CSS and image URLs.

The extension relays postMessage payloads from any HTTPS page to the com.dynamics.vca native app without validating the sender's origin.

Facebook Ad Video Downloader & Ad Data Export lets any webpage trigger its logout and storage reset handler.

Fast Image Research lets any website open reverse-image-search tabs after its optional JavaScript API is enabled.

Give as you Live Donation Reminder sends embedded Basic API credentials to Give as you Live API endpoints.

Goby lets pages set their wallet session origin and use permissions granted to another site.

Google Docs Image Zoom loads GitHub and Ko-fi images when you open its popup.

Gopher Grades posts the user's UMN internet ID to embedded umn.lol course grade iframes.

Grow Bot sends stored SellerAider settings to a Discord webhook when Vinted storage writes hit quota errors.

Hello Kitty Cursor injects an extension-identifying class into pages where it runs.

Highlight Emails in Gmail by cloudHQ sends signed-in Gmail account addresses to www.cloudhq.net during Gmail startup.

Hudl Multi Screen adds page controls whose DOM IDs include its extension runtime ID on Hudl video pages.

Hunter Spy stores Shopee product and search details in page localStorage and hidden DOM markers.

Hyper Bold stores each visited page URL and hostname in local browser storage.

IPTV / HLS player / 7000+ free channels exposes a player page that loads caller-supplied HLS URLs.

Influencer Hero adds a stable extension user ID to its analytics iframe on supported social profile pages.

Internet Security by MetaCert sends visited URLs and Gmail links to MetaCert and puts blocked URLs in a redirect.

Komoot extension sends Komoot user and tour telemetry to komoot-extension.vercel.app when users view tour pages.

Last.fm Scrobbler for YouTube embeds a Last.fm API secret and uses it to sign Last.fm account and scrobble requests.

Luffy Zoro Epic Duo in One Piece Live Wallpaper renders Gameograf-supplied HTML inside its new tab page.

Meltwater Extension lets any website open its extension page and send your active tab URL to Meltwater APIs.

MercadoLibre Herramientas con IA lets any website request fee estimates using stored MercadoLibre user IDs.

Multi-Agent Link Converter Plugin by OGNews redirects shopping product pages to selected agent affiliate URLs.

Music mixer DJMusic sends a persistent Redcoolmedia user ID to stream.redcoolmedia.net during tab activity.

NetHunt CRM for Gmail adds the logged-in email and user ID to its Chrome uninstall URL.

New Lantern sends hardware, window, and page telemetry to Datadog while study or report pages are open.

Olhar Digital Ofertas collects configured checkout page values and sends them to ofertas.olhardigital.com.br.