Low risk browser extensions

YogaPoseTutorial embeds a Spoonacular API key in its new-tab recipe helper.

YouTube Deleted Videos: Track and Restore stores playlist backups in YouTube page localStorage.

YourAIScroll sends account email addresses to www.youraiscroll.com to check subscription status.

shikicinema exposes hardcoded Kodik, Shikimori, and Smarthard API credentials in a web-accessible bundle.

wildberries track & history stores Wildberries bearer-style site tokens in Chrome sync storage.

The extension sends selected page text to games.onlinetechbd.com when its context-menu search is used.

Volume Booster requests Google Fonts when its popup opens, sharing connection metadata with Google.

Adaware AdBlock sends install, update, and daily browser environment telemetry to flow.lavasoft.com.

Torrent Control lets any web page send a magnet URI to the user's configured BitTorrent client.

Lean Library ships a hardcoded API Bearer token in its source and collects the user's IP address at startup for institution detection.

Temp Mail loads Google Fonts from its popup when you open the extension UI.

AI Translation accepts page messages in its translation panel and sends text, page URLs, context, and extension IDs to its API.

Ad Skipper for Pluto TV [QVI] sends Pluto account, profile, bookmark, and continue-watching data to metricmuse.xyz.

Amazon Ad Tag Helper helps advertisers debug Amazon Ad Tag events and attributes on websites.

Audio Booster for Netflix [QVI] collects streaming profiles and viewing history and uploads results to me3x.online.

Automation Anywhere bridges browser activity to a locally installed RPA agent and forwards external web page messages to native host 'aa.browser.shim' without payload validation.

BBB Vote Counter automatically clicks Globo vote-again buttons after successful vote submissions.

BBViewer lets any page trigger a hidden liquid8d.dev iframe that receives the current page URL.

BestSuggest sends page titles, URLs, headings, and meta keywords to its recommendations API on each completed page load.

Blooket Hacker stores matched quiz question and answer text from active pages in Chrome Sync storage.

CloudTalk Click-to-Call lets webpages trigger its inserted phone links to send click-to-call requests to CloudTalk.

Cluing reports page URLs, titles, and reading engagement metrics for visible text blocks to account.cluing.io.

Codes Hunter sends Roblox game activity, copied codes, searches, and a persistent client ID to Google Analytics.

Contador de Seguidores sends selected Instagram account details to Invertexto endpoints.

Cryplex AI Storage Node lets any website set its stored auth token and trigger node sync to app.cryplex.ai.

Dark Mode lets any page trigger extension-powered fetches for CSS and image URLs.

The extension relays postMessage payloads from any HTTPS page to the com.dynamics.vca native app without validating the sender's origin.

Facebook Ad Video Downloader & Ad Data Export lets any webpage trigger its logout and storage reset handler.

Fast Image Research lets any website open reverse-image-search tabs after its optional JavaScript API is enabled.

Give as you Live Donation Reminder sends embedded Basic API credentials to Give as you Live API endpoints.

Goby lets pages set their wallet session origin and use permissions granted to another site.

Google Docs Image Zoom loads GitHub and Ko-fi images when you open its popup.

Gopher Grades posts the user's UMN internet ID to embedded umn.lol course grade iframes.

Grow Bot sends stored SellerAider settings to a Discord webhook when Vinted storage writes hit quota errors.

Hello Kitty Cursor injects an extension-identifying class into pages where it runs.

Highlight Emails in Gmail by cloudHQ sends signed-in Gmail account addresses to www.cloudhq.net during Gmail startup.

Hudl Multi Screen adds page controls whose DOM IDs include its extension runtime ID on Hudl video pages.

Hunter Spy stores Shopee product and search details in page localStorage and hidden DOM markers.

Hyper Bold stores each visited page URL and hostname in local browser storage.

IPTV / HLS player / 7000+ free channels exposes a player page that loads caller-supplied HLS URLs.

Influencer Hero adds a stable extension user ID to its analytics iframe on supported social profile pages.

Internet Security by MetaCert sends visited URLs and Gmail links to MetaCert and puts blocked URLs in a redirect.

Komoot extension sends Komoot user and tour telemetry to komoot-extension.vercel.app when users view tour pages.

Last.fm Scrobbler for YouTube embeds a Last.fm API secret and uses it to sign Last.fm account and scrobble requests.

Luffy Zoro Epic Duo in One Piece Live Wallpaper renders Gameograf-supplied HTML inside its new tab page.

Meltwater Extension lets any website open its extension page and send your active tab URL to Meltwater APIs.

MercadoLibre Herramientas con IA lets any website request fee estimates using stored MercadoLibre user IDs.

Multi-Agent Link Converter Plugin by OGNews redirects shopping product pages to selected agent affiliate URLs.

Music mixer DJMusic sends a persistent Redcoolmedia user ID to stream.redcoolmedia.net during tab activity.

NetHunt CRM for Gmail adds the logged-in email and user ID to its Chrome uninstall URL.

New Lantern sends hardware, window, and page telemetry to Datadog while study or report pages are open.

Olhar Digital Ofertas collects configured checkout page values and sends them to ofertas.olhardigital.com.br.

OneAI Extension lets any visited page trigger authenticated image uploads and OCR/edit workflows.

Push Notifications Blocker lets page scripts trigger its injected UI to allow notifications for the current site.

QweTab lets any website ask the extension to open page-chosen tabs, windows, or incognito windows.

Recipes New Tab requests random recipe results from api.spoonacular.com using a hardcoded API key.

Rex KeepAlive sends encrypted session heartbeat reports with IP address, geolocation, and device fingerprint to Rex.

Right Click Opens Link New Tab lets page-dispatched mouse events open attacker-chosen URLs in new tabs.

SEO-tools sends the active tab URL and domain to SEO, QR, WHOIS, and IP lookup services when its popup opens.

Sakuga Extended runs JavaScript embedded in Sakugabooru comment script tags when post pages load.