Low risk browser extensions

DailyBibleHub includes a Spoonacular API key and sends recipe search requests from its new tab page to Spoonacular.

DailyFactTab sends new-tab fun fact requests to RapidAPI using a hardcoded API key.

DailyWorldAstrology embeds a Spoonacular API key in its new-tab recipe requests to api.spoonacular.com.

DealCloud forwards web page messages from its Gmail proxy into extension background actions.

Dextension sends Dext profile and account analytics identifiers to Segment.

Download YouTube Kids for PC, Mac And Windows uses a hardcoded default lock password and stores it locally.

ESMART Token Web Plugin exposes a PKCS#11 hardware-token API to any webpage via an unauthenticated postMessage bridge injected on all sites.

Easy Mute for Google Meet sends Google Meet page URLs, titles, and a persistent user ID to Google Analytics.

Edit with Sublime Text exposes a web-accessible page any site can embed to write arbitrary content to disk and open it in Sublime Text.

Export Emails to Docs reads Gmail account-switcher email addresses and sends them to cloudHQ during Gmail initialization.

Extrator de token Discord captures Discord account tokens from browser requests, localStorage, and Discord page modules.

FluentAI accepts page messages that can trigger authenticated translation requests.

Free Medium Reader sends the current page URL to freedium-mirror.cfd when its reader overlay opens.

Fusion Narrate Extension relays CustomEvents from any web page to the Dolbey Narrate dictation app via native messaging.

GeePeeTee loads Font Awesome styling from cdnjs.cloudflare.com inside its extension pages.

Notebooklm Source Importer sends selected AI chat and document content to NotebookLM when you export it.

Gloc sends GitHub repository page telemetry to the developer's Umami endpoint.

Gmail Checker sends logged-in Gmail account addresses and browser telemetry to Alibaba Cloud Log Service.

Good Morning - New Tab by cloudHQ sends your Gmail address and account-switcher email list to cloudHQ on Gmail.

HAPPY ORDER injects a page script on shopping sites and disables Taobao anti-risk feature flags.

The extension sends report-issue submissions to Wireframeit with a secret embedded in its service worker.

Impact Factor Finder sends Google Scholar profile details and paper metadata to two Supabase backends.

InboxMailWorld's new-tab page sends recipe API requests to Spoonacular with a bundled API key.

InboxMailZone sends recipe lookup requests from its new-tab page to Spoonacular with a bundled API key.

Joxi runs hotkey listeners on every website and uses Joxi token requests for sign-in and refresh flows.

Lasso lets any web page trigger its injected bridge to open a supplied HTTP(S) URL in a new active tab.

Lessonly Recording exposes its installed status to every page through a DOM marker and window message.

Lionel Messi Wallpapers HD 4K loads notification HTML from api.gameograf.com into its new tab page.

MEGA Pass lets any website detect that the extension is installed through a content-script message probe.

Meet Compute System Recovery Utility sends recovery-target and removable-drive details to Google Analytics when telemetry is enabled.

Microsoft Bing Search & News sends Bing MUID cookie and device telemetry to g.ceipmsn.com over HTTP.

MyWallPaper fetches the user's public IP address from ident.me over cleartext HTTP on the new tab page.

Netflix, Prime, JioCinema, Hotstar - Auto intro skipper sends skip actions and location details to Mixpanel.

ONTO Wallet forwards wallet RPC requests from page frames to the extension as the top-level site.

Owl devtools lets any webpage ask the extension to open its Owl documentation tab.

Password generator loads its popup font stylesheet from Google Fonts over HTTP.

QR Code Reader loads its popup stylesheets from cdnjs.cloudflare.com and cdn.jsdelivr.net when the popup opens.

RECEPTIONIST Chrome Extension adds installed extension names and versions to Sentry error-reporting context.

Rewards Auto Search reports high automated-search counts and a persistent extension token to its backend.

SADocumentExtension relays arbitrary CustomEvent payloads from any web page to the native host sa.document.extension with no filtering.

SIU Library collects search terms and subscribed e-resource browsing URLs for MyLOFT analytics.

Save Emails to Dropbox by cloudHQ sends Gmail account-switcher email addresses to cloudHQ during its pre-user check.

Seismic sends visited page URLs to integrations.knowledge.seismic.com when knowledge triggers are enabled.

Shopping Assistant sends shopping page details to joinsafedeal.com and checks visited domains with reputation services.

Signitic sends Gmail compose recipient addresses to hub.signitic.com when contact-list banners are enabled.

SquarespaceWebsites Tools PRO lets allowed Squarespace and Squarewebsites pages read cached site export data.

Star Wars Weather sends visited-site hostnames to Google and precise location to OpenWeather for new-tab features.

Stash lets localhost:3000 pages read open tabs, bookmarks, and stored Stash data through its message bridge.

Twitch Stats by Streams Charts embeds a signing secret used for its StreamsCharts API authorization tokens.

Strongbox AutoFill accepts postMessage commands from any web origin to fill credentials into forms or open new browser tabs.

Tab Wheel Scroll listens for wheel gestures on pages and switches the active tab when matching events occur.

The Amazon ASIN Checker sends browsing data and account email to api.asincheckr.com and injects the server's HTML response into the page.

TrustPlugin relays page messages to a native PKI host without origin validation, exposing certificate enumeration and signing to any site.

Turbo.net Extension forwards every browser navigation URL to a locally installed Turbo.net sandman process via WebSocket.

UBC Workday Side by Side Calendar copies MyWorkday cookies into browser request header rules.

UiPath downloads and executes JavaScript code supplied by a local native host in both its background page and every web page visited.

Vocal reports some API errors to Sentry with request options that can include Authorization bearer headers.

Website Translator sends selected page text to Google Translate and opens whole-page translations with the current URL.

Yandex.Music Extension exposes its Chrome runtime ID to Yandex Music pages through a DOM attribute.